Proximity Credential Sharing

Abstract

The present invention discloses technologies related to user authentication. In some embodiments, a first computing device receives a request for user credentials to be entered into an authentication prompt associated with the second device from a second computing device. The first computing device determines the proximity associated with the second computing device based on the received wireless location beacon, and presents a selection prompt requiring the user of the first computing device to select the user credentials stored in the first computing device based on the request and the determined proximity. The first computing device then provides the selected user credentials to the second computing device for entry into the authentication prompt. In some embodiments, the first computing device receives a wireless location beacon from a remote controller of the second computing device, and determines the proximity based on the signal strength associated with the received location beacon.

Description

[0001] Background Technical Field

[0002] The present disclosure relates generally to computing devices and, more particularly, to user authentication. Background Art

[0003] Many online services typically require users to create credentials such as a username and password when registering with the service in order to facilitate subsequent user authentication. Users may want to use short passwords or reuse the same password in the service because it is easier to remember the password. However, these actions may make it easier to leak passwords and gain access to multiple accounts of the user. In order to prevent this behavior, computing devices may provide the ability to maintain user passwords. For example, many modern web browsers can detect when a user has entered a password in a web page and provide the ability to store the password for use in subsequent authentication using the web page. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Figure 1 is a block diagram illustrating an example of a system for sharing credentials between devices.

[0005] Figure 2 is a communication diagram illustrating an example of an exchange between devices that share credentials.

[0006] FIG. 3A to FIG. 3D Various examples of prompts presented to a user to share credentials between devices are shown.

[0007] FIG. 4A to FIG. 4C is a flow chart illustrating an exemplary method for sharing credentials.

[0008] Figure 5 is a block diagram illustrating one embodiment of an exemplary computer system.

[0009] This disclosure includes references to "one embodiment" or "an embodiment." The appearance of the phrase "in one embodiment" or "in an embodiment" does not necessarily refer to the same embodiment. The particular features, structures, or characteristics may be combined in any suitable manner consistent with the present disclosure.

[0010] Within the present disclosure, different entities (which may be variously referred to as "units," "circuits," other components, etc.) may be described or claimed as being "configured to" perform one or more tasks or operations. This expression—[an entity] configured to [perform one or more tasks]—is used herein to refer to a structure (i.e., a physical thing, such as an electronic circuit). More specifically, this expression is used to indicate that this structure is arranged to perform one or more tasks during operation. A structure may be said to be "configured to" perform a task even if the structure is not currently being operated. "A computing device configured to present prompts on a display" is intended to cover, for example, a device having display pipeline circuits and / or a memory having program instructions that can be executed by a processor to perform the function during operation, even if the device in question is not currently being used (e.g., a power source is not connected to it). Therefore, an entity described or stated as "configured to" perform a task refers to a physical thing used to implement the task, such as a device, a circuit, a memory storing executable program instructions, etc. The phrase is not used herein to refer to an intangible thing. Thus, a "configured to" structure is not used herein to refer to a software entity, such as an application programming interface (API).

[0011] The term “configured to” is not intended to mean “configurable to.” For example, an unprogrammed FPGA would not be considered “configured to” perform a particular function, although it may be “capable of being configured to” perform that function and may be “configured to” perform that function after being programmed.

[0012] The recitation of a structure in the appended claims as "configured to" perform one or more tasks is expressly intended to define the claim element. No Invoking 35 U.S.C. § 112(f). Thus, no claim in this application as filed is intended to be interpreted as having means-plus-function elements. If the applicant wishes to invoke section 112(f) during the prosecution of the application, it will use the “means for [performing the function]” construction to phrase the claim elements.

[0013] As used herein, the terms "first," "second," and the like act as labels for the nouns that follow them and do not imply any type of ordering (e.g., spatial, temporal, logical, etc.) unless explicitly stated. For example, a mobile device may have a first credential and a second credential. The term "first" is not limited to the initial credential on a device. Thus, the term "first" may be used to refer to any credential on a device.

[0014] As used herein, the term "based on" is used to describe one or more factors that influence a determination. The term does not exclude that there may be additional factors that may influence the determination. That is, a determination may be based only on the specified factors or on the specified factors and other unspecified factors. Consider the phrase "determining A based on B." This phrase specifies that B is a factor used to determine A or that B influences the determination of A. This phrase does not exclude that the determination of A may also be based on some other factor such as C. The phrase is also intended to cover embodiments in which A is determined based only on B. As used herein, the phrase "based on" is therefore synonymous with the phrase "based at least in part on." DETAILED DESCRIPTION

[0015] The present disclosure describes an embodiment in which a user may have one or more authentication credentials stored on a first computing device but is interacting with a second computing device attempting to authenticate the user. As will be described in more detail below in various embodiments, the second computing device may be configured to send a request to nearby devices asking them to provide credentials associated with user authentication. In response to receiving the request, the first device may present a prompt asking the user whether he or she wants to provide the stored credentials to the second device. For example, in some embodiments, the second computing device may be a media player device that presents an authentication prompt on a television. The user's nearby mobile device, for example, may present a prompt asking the user to select a stored username and password to provide to the media player device, rather than manually entering the username and password via the device's remote controller.

[0016] In order to reduce the number of potential devices that respond to the second device, in various embodiments, the second device may cause a location beacon that can be used by nearby devices to determine the proximity to the second device to be sent. (As used herein, the term "proximity" generally refers to any suitable measure indicating the distance between two devices.) If the device determines that the proximity is within a threshold range, it may prompt its user to select credentials to provide to the second device. Otherwise, the device may ignore the request without disturbing the user. Therefore, for example, a person in the same room as the above-mentioned media player device may receive a prompt on his or her mobile device, but a person in another room may not be disturbed despite his or her mobile device receiving a credential request. Further, in some embodiments, the location beacon is sent from the remote controller of the second device because the remote controller may be closer to the user being authenticated, and thereby allows nearby devices to consider a smaller threshold range, thereby reducing the number of devices that potentially respond and disturbed users. However, in other embodiments, the location beacon may be sent by the second device or another peripheral device associated with the second device.

[0017] Now turn to Figure 1, which shows a block diagram of a credential sharing system 10. In the illustrated embodiment, the system 10 includes a media player device 110 coupled to a display 120, a wireless remote control 130, and a mobile device 140. In some embodiments, the system 10 can be implemented differently than shown—for example, the display 120 can be integrated into the device 110, the mobile device 140 can be one of multiple devices 140, the remote control 130 can be absent, etc.

[0018] In various embodiments, the media player device 110 is a device configured to present content on a display 120. In the illustrated embodiment, the content may include various media played on the display 120, which in some embodiments may be a television. However, the device 110 may correspond to any suitable computing device, such as a laptop or notebook computer, a personal computer system, a desktop computer, a server system, a mainframe computer system, a tablet computer, a handheld computer, a workstation, a network computer, a mobile phone, a music player, a personal data assistant (PDA), a wearable device, an Internet of Things (IoT) device, etc. In some embodiments, the media player device 110 includes a wireless interface configured to communicate with a wireless remote controller 130 (or simply remote controller 130), which may receive various inputs from the device 110 and provide indications of the inputs to the device 110 to control the operation of the device 110. The remote controller 130 may support various wireless protocols such as infrared (IR), Bluetooth, etc. TM , Wi-Fi TM , ultra-wideband (UWB), etc. Although various functions will be described below with respect to the remote control 130, the functions may be performed by some other peripheral devices associated with the device 110, such as a wireless keyboard, a mouse, a speaker, some other device paired with the device 110, etc.

[0019] In some cases, the media player device 110 may present an authentication prompt 112 requesting credentials for authenticating the user. In some embodiments, the prompt 112 is provided by an application executed on the device and is provided to authenticate relative to the service. The service may involve, for example, accessing content maintained by the application, enabling the function of the application, logging into the application, etc. The service may also involve accessing information located outside the media player device 110. For example, the prompt 112 may be presented by an application associated with a streaming service and executable to stream various video contents to the media player device 110. In some embodiments, the prompt 112 is presented by a web browser executable to present a web page on a display 120--therefore, the authentication prompt 112 may correspond to an authentication page of a website. In other embodiments, when requesting credentials 144, the device 110 may not present any prompt--for example, the device 110 may not have a display, and if a mobile device 140 with relevant credentials can be identified, the device 110 may determine to abandon the presentation prompt 112, etc.

[0020] In various embodiments, the mobile device 140 is configured to maintain various credentials 144 that may be associated with the authentication prompt 112. These credentials 144 may include any suitable type of credentials, such as a username and password, a one-time password (OTP), a personal identification number (PIN), a digital signature generated by a cryptographic key, an authentication token, etc. Although described as a mobile device 140, the device 140 may correspond to any suitable device, such as those described above with respect to the media player device 110. Figure 1 As shown, the mobile device 140 may receive the credential request 114 and the location beacon 132 and present a corresponding selection prompt 142 for selecting credentials 144 to provide to the media player device 110 .

[0021] In various embodiments, the media player device 110 sends a credential request 114 to one or more nearby devices in response to a user providing some input to the device 110 via the remote control 130. For example, the user may navigate one or more menus shown on the display 120, causing the authentication prompt 112 to be presented, and the request 114 may be sent in response to the user selecting a field in the authentication prompt 112 via the remote control 130. In some embodiments, the request 114 may be sent as a broadcast (i.e., a communication that is not specifically directed to any device) and may be a generic advertisement for credentials 144, in that information about specific desired credentials 144 may be transmitted later once a secure connection is established with the device that responded to the request 114. However, in other embodiments, the request 114 may be directed to one or more specific devices 140 and / or include additional information about the desired credentials 144, such as described below with respect to the authentication prompt 112. Figure 2 described.

[0022] As described above, the location beacon 132 may be transmitted to nearby devices so that they determine whether to respond to the credential request 114. In various embodiments, the mobile device 140 uses the location beacon 132 to determine the proximity associated with the media player device 110. In some embodiments, the determination includes receiving an indication of the signal strength associated with the received location beacon 132 from the radio component of the mobile device 140 (e.g., a relative signal strength indication (RSSI)), and comparing the signal strength with a threshold. If the signal strength meets the threshold (meaning that the mobile device 140 is within a sufficient range), the device 140 may determine to notify the user of the device 140 of the request 114. If the signal strength does not meet the threshold, the mobile device 140 may determine to ignore the received request 114. In the illustrated embodiment, the location beacon 132 is sent from the remote control 130, because since the remote control 130 may be closer to the mobile device 140 than the media player device 110, it may allow the use of a higher threshold. However, in other embodiments, the location beacon 132 may be transmitted by the media player device 110 or some other peripheral device of the device 110. For example, one or more other neighboring devices may send a location beacon 132 to the mobile device 140, or transmit some other form of location information, such as a data packet identifying a location determined by one of the neighboring devices. These neighboring devices may also be any suitable radio access technology (RAT), such as infrared (IR), Bluetooth, or a wireless radio. TM , Wi-Fi TM , ultra-wideband (UWB), etc. In other embodiments, other techniques may be used to determine whether the mobile device 140 is within a threshold range of the media player device 110, such as being able to access a public wireless access point (WAP) (or public Wi-Fi TM network), use of the Global Positioning System (GPS), use of cellular network connectivity, etc.

[0023] If the mobile device 140 determines to notify the user of the device 140 of the request 114, the device 140 may present one or more prompts to the user, such as a selection prompt 142. In various embodiments, the selection prompt 142 presents a list of credentials 144 stored on the mobile device 140 and allows the user to select one of the credentials 144 to provide to the media player device 110. In some embodiments, the selection prompt 142 may also suggest a specific credential 144 that is determined to be associated with the authentication prompt 112. In some embodiments, the mobile device 140 also presents a device authentication prompt that requires the user to provide input to the media player device 110 that can be used to authenticate the mobile device 140. For example, in one embodiment, the prompt may require the user to enter a code shown on the display 120; however, other techniques as described below may be used. In some embodiments, the mobile device 140 also performs local authentication of the user before allowing the credentials 144 to be provided to the media player device 110. Such authentication may include verifying the user's password, biometrics, etc. Examples of various prompts that may be presented by the mobile device 140 are described below with respect to FIG. 3A to FIG. 3D Discussed in further detail.

[0024] After the user has selected credentials 144 from selection prompt 142, mobile device 140 may provide credentials 144 to media player device 110, such as Figure 1 In various embodiments, in response to receiving the credentials 144, the media player device 110 may automatically populate one or more fields in the authentication prompt 112 with the credentials 144. In some embodiments, the media player device 110 may also automatically submit the contents of the populated one or more fields in response to receiving the credentials 144. However, in other embodiments, the user may be required to select a button using the remote control 130 to submit the credentials 144. Figure 2 Exemplary exchanges between devices 110, 130, and 140 are described in greater detail.

[0025] Now turn to Figure 2 , which shows a communication diagram of an exchange 200 for sharing credentials 144. In the illustrated embodiment, exchange 200 includes a discovery phase 202, a pairing phase 204, and a credential communication phase 206. In other embodiments, exchange 200 can be implemented in different ways, for example, steps can be performed in a different order, simultaneously, or steps can be omitted.

[0026] In various embodiments, the discovery phase 202 is an initial phase in which the media player device 110 attempts to discover nearby devices that may be interested in sharing credentials 144 with the media player device 110. In the illustrated embodiment, phase 202 begins at 210, where a user provides input to the remote control 130 selecting a field in the authentication prompt 112. In response to receiving an indication of the selection, the media player device 110 broadcasts a credential request 114, which is received by the mobile device 140 at 212. The media player device 110 also sends a beacon instruction to the remote control 130 at 214 to cause the remote control 130 to begin sending a location beacon 132 at 216. In response to receiving the beacon 132, the mobile device 140 performs an RSSI determination 218, where the mobile device 140 determines proximity by comparing the RSSI of the received beacon 132 to a threshold. If the RSSI meets the threshold, the mobile device 140 presents an introduction prompt at 220 (see below). Figure 3A ), asking the user 201 whether he or she wants to share credentials 144. If the user indicates in the affirmative, instructions can be provided by the mobile device 140 to the media player device 110 at 222, which sends an instruction to the remote control 130 to stop sending the location beacon 132 at 224. The exchange 200 then proceeds to the pairing stage 204.

[0027] In various embodiments, the pairing phase 204 is an intermediate phase in which devices 110 and 140 authenticate each other and establish a secure communication channel. In the illustrated embodiment, phase 204 begins at 226, where mobile device 140 presents a device authentication prompt (hereinafter referred to as 226) requiring user 201 to enter authentication information. Figure 3B ), the authentication information is transmitted to the media player device 110 at 228 to authenticate the mobile device 140 and the media player device 110. In some embodiments, the media player device 110 presents a value on the display 120, and the device authentication prompt requires the user 201 to enter the value into the prompt; however, in other cases, other techniques may be used. After confirming the authentication information, the media player device 110 establishes a secure / encrypted channel with the mobile device 140 at 230 to protect subsequent communications between the devices 110 and 140. In some embodiments, this may include performing a Diffie-Hellman (DH) key exchange to establish an encryption key for encrypting and decrypting subsequent communications. The exchange 200 then proceeds to the credential communication phase 206.

[0028] In various embodiments, the credential communication phase 206 is the last phase in which the selected credentials 144 are transmitted. In the illustrated embodiment, phase 206 begins at 232, where the media player device 110 provides information about the authentication prompt 112 via a secure channel, such as a service identifier and a credential type. In various embodiments, the service identifier indicates the specific service for which the authentication prompt 112 is presented. Thus, if the prompt 112 is being presented to authenticate a service associated with a website, the service identifier may identify the specific website by specifying, for example, a domain, a uniform resource locator (URL), an Internet Protocol (IP) address, etc. If the prompt 112 is being presented to authenticate a service provided by an application executing on the media player device 110, the service identifier may identify the specific application by specifying, for example, the name of the application, the name of the executable file of the application, the directory path to the executable file, etc. In various embodiments, the credential type identifies the type of credential 144 requested by the authentication prompt 112, such as a username and password, an OTP, a PIN, a digital signature generated by an encryption key, an authentication token, etc. At 234, the mobile device 140 presents the credential selection prompt 142 (hereinafter referred to as "credential selection prompt"). Figure 3C ), the credential selection prompt may include suggested credentials 144 determined to be relevant based on the information received at 232. In some embodiments, the mobile device 140 may further authenticate the user 201 by verifying the user's password, biometrics, etc. before presenting the selection prompt 142. Once the user 202 has selected the credentials 144 from the selection prompt 142 at 236, the mobile device 140 provides the selected credentials 144 at 238. In some embodiments, the media player device 100 may send a confirmation of the successful receipt of the credentials 144 at 240, and a corresponding success prompt (hereinafter with respect to Figure 3D The credentials 144 may be presented to the user 201 at 242. At 244, the media player device 110 automatically populates one or more fields in the authentication prompt 112 with the contents of the credentials 144. In an embodiment where the prompt 112 is not presented, the media player device 110 may transmit the credentials 144 to a service that attempts to authenticate the user in some other manner.

[0029] Now turn to Figure 3A, which shows a diagram of an introduction prompt 300. As described above, the introduction prompt 300 can be an initial prompt presented during the discovery phase 202 and used to confirm that the user is interested in sharing the credentials 144. In the illustrated embodiment, the prompt 300 includes a "Continue" button that can be selected by the user to indicate to the media player device 110 that he or she is interested in sharing the credentials 144. Otherwise, the user can select the "X" button to cancel the prompt 300. In some embodiments, the introduction prompt 300 can be implemented in a manner different from that shown - for example, the prompt 300 can be a banner that drops down from the top of the screen.

[0030] Now turn to Figure 3B , which shows a diagram of a device authentication prompt 310. As described above, the device authentication prompt 310 can be presented during the pairing stage 204 to authenticate the mobile device 140 and the media player device 110. In the illustrated embodiment, the prompt 310 requires the user to enter a four-digit value shown on the display 120 in order to authenticate the devices 110 and 140. For example, such authentication can be performed to prevent a person who cannot view the display 120 from interfering with the media player device 110. In some embodiments, the authentication prompt 310 is performed during each exchange 200. In other embodiments, the authentication can continue across multiple exchanges 200—for example, the mobile device 140 can receive a token from the media player device 110 to use in place of the prompt 310.

[0031] In other embodiments, the mobile device 140 and the media player device 110 may communicate with Figure 3B For example, in some embodiments, the media player device 110 may present, for example, a QR code, a particle cloud, etc., on the display 120, and the prompt 310 may instruct the user to capture it with the camera of the mobile device 140. In some embodiments, the media player device 110 may play a sound with a watermark, and the mobile device 140 may capture the watermark via the microphone of the device 140 to authenticate to the media player device 110. In some embodiments, the devices 110 and 140 may be authenticated based on the two devices being registered with the same cloud-based user account.

[0032] Now turn to Figure 3C , which shows an illustration of a selection prompt 142. As described above, the selection prompt 142 can be presented during the credential selection phase 206 to allow the user to select credentials 144 to provide to the media player device 110. In the illustrated embodiment, the selection prompt 142 presents a list of credentials 144 maintained by the mobile device 140 and the suggested credentials 322. Thus, selecting credentials for apricot.com, for example, can cause the media player device 110 to receive the credentials 144 and Figure 1112 of prompt 112 is populated with "jennyappleseed" in the username field and the corresponding password in the password field. In some embodiments, the suggested credentials 322 may be determined based on information received during stage 206, such as a service identifier and a credential type. In other embodiments, the suggested credentials 322 may be determined based on the most frequently used credentials 144, the most recently used credentials 144, etc. If the shown portion of the credential list does not include the desired credential, the user may scroll through the list or enter an input into the shown search field to search for the desired credential. In the illustrated embodiment, selecting the "i" icon may allow the user to view additional information about the credential 144, such as the credential type, service identifier, etc.

[0033] Now turn to Figure 3D , which shows an illustration of a success prompt 330. As described above, in response to the device 140 successfully sharing the credentials 144 with the media player device 110, the success prompt 330 may be presented on the mobile device 140 during the selection phase 206. In the illustrated embodiment, the success prompt 330 announces that the credentials are shared successfully and has a "Done" button to confirm the prompt. However, in some embodiments, the success prompt 330 may be implemented in a manner different from that shown in the figure - for example, it may be a banner that falls from the top, may not have a confirmation button, etc. In other embodiments, the success prompt 330 may not be presented.

[0034] Now turn to Figure 4A , which shows a flow chart of a method 400 for sharing credentials. In some embodiments, the method 400 is performed by a first computing device that possesses the credentials, such as mobile device 140. In some embodiments, steps 405-420 may be performed in parallel or may be performed in a different order than shown.

[0035] In step 405 , a request (eg, request 114 ) is received from a second computing device (eg, media player device 110 ) for user credentials (eg, credentials 144 ) to be entered into an authentication prompt (eg, prompt 112 ) associated with the second computing device.

[0036] In step 410, a proximity associated with the second computing device is determined based on the received wireless location beacon (e.g., location beacon 132). In some embodiments, the first computing device receives the wireless location beacon from a remote controller (e.g., remote control 130) of the second computing device, and determining the proximity includes determining the proximity to the remote controller based on a signal strength associated with the received wireless location beacon. In some embodiments, the first computing device receives a relative signal strength indication (RSSI) from a radio component of the first computing device that receives the wireless location beacon, and compares the received RSSI to a threshold.

[0037] In step 415, based on the request and the determined proximity, a selection prompt (e.g., selection prompt 142) is presented that requires the user of the first computing device to select a user credential stored in the first computing device. In some embodiments, the first computing device stores multiple user credentials in the first computing device, receives an indication of the desired user credential from the second computing device, and based on the indication, selects one of the multiple user credentials to suggest to the user within the selection prompt (e.g., credential suggestion 322). In some embodiments, the indication identifies an application executing on the second computing device. In some embodiments, the indication is a domain associated with a website being accessed by a web browser of the second computing device. In some embodiments, the indication is received after an encrypted channel has been established between the first computing device and the second computing device.

[0038] In step 420, the selected user credentials are provided to the second computing device for input into the authentication prompt. In some embodiments, the first computing device presents a prompt (e.g., device authentication prompt 310) requiring the user to provide an input that can be used to authenticate the first computing device to the second computing device, and based on the input, an encrypted channel (e.g., a secure channel at 230) is established with the second computing device so that the selected user credentials are provided via the encrypted channel. In some embodiments, the prompt requiring the user to provide an input that can be used to authenticate the first computing device requires the user to enter a value shown on a display associated with the second computing device (e.g., display 120). In various embodiments, method 400 also includes the first computing device receiving another request for user credentials to be entered into the authentication prompt from the second computing device, and in response to determining that the first computing device is not near a remote controller of the second computing device, determining to ignore the other request.

[0039] Now turn to Figure 4B , which shows a flow chart of a method 430 for sharing credentials. In some embodiments, the method 430 is performed by a first computing device presenting an authentication prompt, such as the media player device 110. In some embodiments, steps 435-455 may be different from the steps shown—for example, the steps may be performed simultaneously or the steps may be performed in a different order than shown, and steps such as steps 435 and 455 may be omitted.

[0040] In step 435, an authentication prompt (e.g., prompt 112) is presented that requires user credentials (e.g., credentials 144) to authenticate the user. In some embodiments, the first computing device receives input from a remote controller (e.g., remote controller 130), determines that the input selects a field within the authentication prompt, and in response to the determination, performs steps 440 and 445.

[0041] In step 440, a request for user credentials (e.g., request 114) is sent to a second computing device (e.g., mobile device 140). In some embodiments, the first computing device executes an application associated with the streaming service, and the authentication prompt can be used to authenticate the user to the streaming service. In such embodiments, the first computing device sends an indication of the application (e.g., the service identifier at 232) to the second computing device so that the second computing device suggests user credentials associated with the application (e.g., suggested credentials 322) for user selection. In some embodiments, the first computing device presents a web page including the authentication prompt and sends an indication of a domain name associated with the web page (e.g., the service identifier at 232) to the second computing device so that the second computing device suggests user credentials associated with the domain name (e.g., suggested credentials 322) for user selection.

[0042] In step 445, the remote controller is instructed (e.g., via the beacon instruction at 214) to send a location beacon (e.g., location beacon 132) that can be used by the second computing device to determine whether to request user input based on a threshold distance between the remote controller and the second computing device.

[0043] In step 450, user credentials selected by a user of the second computing device are received from the second computing device. In some embodiments, method 430 includes presenting a prompt by the first computing device that specifies a value for the user to enter into the second computing device to authenticate the second computing device (e.g., authentication information at 228), and in response to the user entering the value into the second computing device (e.g., in device authentication prompt 310), establishing a secure channel with the second computing device (e.g., the secure channel at 230) to receive the selected user credentials.

[0044] In step 455, the received user credentials are used to populate (e.g., automatically populate at 244) one or more fields in the authentication prompt. In some embodiments, in response to receiving the selected user credentials, the first computing device automatically submits the contents of the populated one or more fields to the authentication service.

[0045] Now turn to Figure 4C , which shows a flow chart of a method 460 for sharing credentials. In some embodiments, the method 460 is performed by a remote controller such as the remote controller 130.

[0046] In step 465, a remote controller of a media player device (e.g., media player device 110) receives a request (e.g., beacon instruction at 214) to broadcast a location beacon (e.g., location beacon 132) associated with an authentication prompt (e.g., prompt 112) presented by the media player device on a display (e.g., display 120). In some embodiments, method 460 includes the remote controller receiving input from a user selecting an authentication field in the authentication prompt, and the remote controller sending an indication of the input to the media player device (e.g., field selection at 210). In such embodiments, the request to broadcast the location beacon is received in response to sending the indication of the input.

[0047] In step 470, in response to the request, the remote controller broadcasts a location beacon to the mobile device (e.g., mobile device 140). In various embodiments, the location beacon can be used by the mobile device to determine whether to provide user-selected credentials (e.g., credentials 144) to the media player device for entry into one or more fields of the authentication prompt. In some embodiments, the mobile device determines the proximity of the remote controller using the signal strength associated with the broadcasted location beacon, and the mobile device determines whether to prompt the user to select user credentials (e.g., via selection prompt 142) based on the determined proximity. In some embodiments, method 460 includes the remote controller receiving an indication from the media player device that the mobile device has connected to the media player device (e.g., a termination instruction at 224), and in response to the indication, the remote controller terminates broadcasting the location beacon.

[0048] Exemplary Computer System

[0049] Now go to Figure 5 , which shows a block diagram describing an exemplary embodiment of a computing device 500 that can implement the functionality of devices 110-140. Device 500 can correspond to any suitable computing device, such as the one described above with respect to Figure 1 In the illustrated embodiment, device 500 includes architecture 510, processor complex 520, graphics unit 530, display unit 540, cache / memory controller 550, input / output (I / O) bridge 560. In some embodiments, elements of device 500 may be included in a system on a chip (SOC).

[0050] Structure 510 may include various interconnects, buses, MUXs, controllers, etc., and may be configured to facilitate communication between various elements of device 500. In some embodiments, portions of structure 510 may be configured to implement a variety of different communication protocols. In other embodiments, structure 510 may implement a single communication protocol, and elements coupled to structure 510 may be internally converted from the single communication protocol to other communication protocols. As used herein, the term "coupled to" may indicate one or more connections between elements, and a coupling may include intermediate elements. For example, in Figure 5 In FIG, graphics unit 530 may be described as being "coupled to" memory via structure 510 and cache / memory controller 550. In contrast, in Figure 5 In the illustrated embodiment, graphics unit 530 is "directly coupled" to structure 510 because there are no intervening elements.

[0051] In the illustrated embodiment, processor complex 520 includes bus interface unit (BIU) 522, cache 524, and cores 526A and 526B. In various embodiments, processor complex 520 may include various numbers of processors, processor cores, and / or caches. For example, processor complex 520 may include 1, 2, or 4 processor cores, or any other suitable number. In one embodiment, cache 524 is a set associative L2 cache. In some embodiments, cores 526A and / or 526B may include internal instruction and / or data caches. In some embodiments, a consistency unit (not shown) in structure 510, cache 524, or elsewhere in device 500 may be configured to maintain consistency between the various caches of device 500. BIU 522 may be configured to manage communications between processor complex 520 and other elements of device 500. Processor cores such as core 526 may be configured to execute instructions of a particular instruction set architecture (ISA), which may include operating system instructions and / or application instructions to implement the functionality described herein with respect to devices 110-140. These instructions may be stored in a computer-readable medium, such as a memory coupled to a memory controller 550 discussed below.

[0052] Graphics unit 530 may include one or more processors and / or one or more graphics processing units (GPUs). For example, graphics unit 530 may receive graphics-oriented instructions such as Metal or Instructions. Graphics unit 530 may execute dedicated GPU instructions or perform other operations based on the received graphics-oriented instructions. Graphics unit 530 may generally be configured to process large blocks of data in parallel and may build images in a frame buffer for output to a display. Graphics unit 530 may include transformation, lighting, triangle and / or rendering engines in one or more graphics processing pipelines. Graphics unit 530 may output pixel information for displaying an image.

[0053] The display unit 540 may be configured to read data from the frame buffer and provide a stream of pixel values ​​for display. In some embodiments, the display unit 540 may be configured as a display pipeline. In addition, the display unit 540 may be configured to blend multiple frames to produce an output frame. In addition, the display unit 540 may include one or more interfaces (e.g., a touch screen or an external display) for coupling to a user display such as the display 120. or embedded DisplayPort (eDP).

[0054] The cache / memory controller 550 may be configured to manage data transfers between the structure 510 and one or more caches and / or memories. For example, the cache / memory controller 550 may be coupled to an L3 cache, which in turn may be coupled to a system memory. In other embodiments, the cache / memory controller 550 may be directly coupled to the memory. In some embodiments, the cache / memory controller 550 may include one or more internal caches. The memory coupled to the memory 550 may be any type of volatile memory, such as a dynamic random access memory (DRAM), a synchronous DRAM (SDRAM), a double data rate (DDR, DDR2, DDR3, etc.) SDRAM (including a mobile version of SDRAM, such as mDDR3, etc., or a low power version of SDRAM, such as LPDDR4, etc.), a RAMBUS DRAM (RDRAM), a static RAM (SRAM), etc. One or more memory devices may be coupled to a circuit board to form a memory module, such as a single inline memory module (SIMM), a dual inline memory module (DIMM), etc. Alternatively, the device may be mounted with the integrated circuit in a chip-on-chip structure, a package-on-package structure, or a multi-chip module structure. The memory coupled to the controller 550 may be any type of non-volatile memory, such as NAND flash memory, NOR flash memory, nano RAM (NRAM), magnetoresistive RAM (MRAM), phase change RAM (PRAM), racetrack memory, memristor memory, etc. As described above, the memory may store program instructions executable by the processor complex 520 to cause the device 500 to perform the functions described herein.

[0055] The I / O bridge 560 may include various elements configured to implement, for example, Universal Serial Bus (USB) communications, security, audio, and / or low-power always-on functionality. The I / O bridge 560 may also include interfaces such as pulse width modulation (PWM), general purpose input / output (GPIO), serial peripheral interface (SPI), and / or inter-integrated circuit (I2C). Various types of peripherals and devices may be coupled to the device 500 via the I / O bridge 560. For example, these devices may include various types of wireless interfaces (e.g., Wi-Fi enabled). TM ,Bluetooth TM , cellular, global positioning system, etc.), additional storage (e.g., RAM storage, solid-state storage, or disk storage), user interface devices (e.g., keyboards, microphones, speakers, etc.), etc.

[0056] ***

[0057] Although specific embodiments have been described above, these embodiments are not intended to limit the scope of the present disclosure, even when only a single embodiment is described with respect to specific features. The feature examples provided in this disclosure are intended to be illustrative, not limiting, unless otherwise stated. The above description is intended to cover such alternatives, modifications, and equivalents, which will be apparent to those skilled in the art who are aware of the effective effects of the present disclosure.

[0058] The scope of the present disclosure includes any feature or combination of features disclosed herein (explicitly or implicitly) or any generalization thereof, whether or not it mitigates any or all of the problems addressed herein. Accordingly, new claims may be made during the prosecution of this patent application (or a patent application claiming priority thereto) for any such combination of features. In particular, with reference to the appended claims, features of the dependent claims may be combined with features of the independent claims, and features from the corresponding independent claims may be combined in any appropriate manner and not just by the specific combinations listed in the appended claims.

[0059] Various embodiments described herein may collect and / or use data obtained from specific and legitimate sources to improve the delivery of inspirational content or any other content that may be of interest to users. The present disclosure contemplates that, in some instances, the collected data may include personal information data that uniquely identifies or can be used to identify a specific person. Such personal information data may include demographic data, location-based data, online identifiers, phone numbers, email addresses, home addresses, data or records related to a user's health or fitness level (e.g., vital signs measurements, medication information, exercise information), date of birth, or any other personal information.

[0060] The present disclosure recognizes that the use of such personal information data in the present technology can be used to benefit users. For example, personal information data can be used to deliver targeted content that users may be more interested in based on their preferences. Therefore, the use of such personal information data enables users to have greater control over the content delivered. In addition, the present disclosure also anticipates other uses of personal information data that benefit users. For example, health and fitness data can be used according to the user's preferences to provide insights into their overall health, or can be used as positive feedback to individuals who use technology to pursue health goals.

[0061] This disclosure envisions that entities responsible for collecting, analyzing, disclosing, transmitting, storing or otherwise using such personal information data will comply with established privacy policies and / or privacy practices. Specifically, such entities will be expected to implement and consistently apply privacy practices that are generally recognized as meeting or exceeding the requirements of the industry or government that maintain user privacy. Such information about the use of personal data should be prominently and easily accessible to users, and should be updated as the collection and / or use of data changes. The user's personal information should be collected only for legitimate use. In addition, such collection / sharing should only occur after receiving user consent or other legal basis specified in applicable law. In addition, such entities should consider taking any necessary steps to defend and safeguard access to such personal information data and ensure that others who have access to personal information data comply with their privacy policies and processes. In addition, such entities may subject themselves to third-party assessments to demonstrate their compliance with widely accepted privacy policies and practices. In addition, policies and practices should be adjusted for specific types of personal information data collected and / or accessed, and applied to applicable laws and standards, including specific considerations that are exclusive to jurisdictions that can be used to impose higher standards. For example, in the United States, collection or access to certain health data may be governed by federal and / or state laws, such as the Health Insurance Portability and Accountability Act (HIPAA); while health data in other countries may be subject to other regulations and policies and should be handled accordingly.

[0062] Regardless of the foregoing, the present disclosure also contemplates implementation schemes in which users selectively block the use or access of personal information data. That is, the present disclosure contemplates that hardware elements and / or software elements may be provided to prevent or block access to such personal information data. For example, with respect to an advertising delivery service, the technology of the present invention may be configured to allow a user to choose to "opt in" or "opt out" to participate in the collection of personal information data at any time during or after registration for the service. In another example, a user may choose not to provide emotion-related data for a target content delivery service. As another example, a user may choose to limit the length of time that emotion-related data is retained, or to completely block the development of basic emotional conditions. In addition to providing "opt-in" and "opt-out" options, the present disclosure contemplates providing notifications related to access or use of personal information. For example, a user may be notified that their personal information data will be accessed when downloading an application, and then reminded again just before the personal information data is accessed by the application.

[0063] In addition, it is an object of the present disclosure that personal information data should be managed and processed to minimize the risk of unintentional or unauthorized access or use. Risks can be minimized by limiting data collection and deleting data once it is no longer needed. In addition, and when applicable, including in certain health-related applications, data de-identification can be used to protect the privacy of users. De-identification can be facilitated by removing identifiers, controlling the amount or specificity of stored data (e.g., collecting location data at a city level rather than at an address level), controlling how data is stored (e.g., aggregating data across users), and / or other methods such as differential privacy, where appropriate.

[0064] Thus, while the present disclosure may broadly cover the use of personal information data to implement one or more of the various disclosed embodiments, the present disclosure also contemplates that various embodiments may also be implemented without access to such personal information data. That is, various embodiments of the present technology will not fail to function properly due to the lack of all or a portion of such personal information data. For example, content may be selected and delivered to a user based on aggregated non-personal information data or an absolute minimum amount of personal information, such as content processed only on the user's device or other non-personal information that may be used for content delivery services.

Claims

1. A computer-readable medium for sharing credentials, the computer-readable medium having program instructions stored therein, the program instructions being executable by a first computing device to cause the first computing device to perform operations including: receiving, from a second computing device, a request for user credentials to be entered into an authentication prompt associated with the second computing device; In response to receiving the request, determining a proximity associated with the second computing device based on wireless location beacons received from neighboring devices different from the first computing device and the second computing device; determining, based on the determined proximity, whether to present a selection prompt requesting a user of the first computing device to select user credentials stored in the first computing device; as well as In response to determining that a selection prompt is presented and the user selects user credentials, the selected user credentials are provided to the second computing device for input into the authentication prompt.

2. The computer-readable medium of claim 1, wherein determining the proximity comprises determining the proximity to the neighboring device based on a signal strength associated with a received wireless location beacon.

3. The computer-readable medium of claim 2, wherein determining the proximity comprises: receiving a relative signal strength indication RSSI from a radio component of the first computing device that received the wireless location beacon; as well as The received RSSI is compared to a threshold value.

4. The computer-readable medium of claim 1, wherein the operations comprise: presenting a prompt requesting the user to provide input to the second computing device that can be used to authenticate the first computing device; as well as Based on the input, an encrypted channel is established with the second computing device, wherein the selected user credentials are provided via the encrypted channel. 5 . The computer-readable medium of claim 4 , wherein the prompt requires the user to enter a value shown on a display associated with the second computing device.

6. The computer-readable medium of claim 1, wherein the operations comprise: storing a plurality of user credentials in the first computing device; receiving an indication of desired user credentials from the second computing device; as well as Based on the indication, one of the plurality of user credentials is selected to be suggested to the user within the selection prompt.

7. The computer-readable medium of claim 6, wherein the indication is used to identify an application executing on the second computing device.

8. The computer-readable medium of claim 6, wherein the indication is a domain associated with a website being accessed by a web browser of the second computing device.

9. The computer-readable medium of claim 6, wherein the indication is received after an encrypted channel has been established between the first computing device and the second computing device.

10. The computer-readable medium of claim 1, wherein the operations comprise: receiving, from the second computing device, another request for user credentials to be entered into an authentication prompt; as well as In response to determining that the first computing device is not in the vicinity of the neighboring device, it is determined to ignore the other request.

11. A system for sharing credentials, comprising: a first computing device; a second computing device; as well as Adjacent equipment; Wherein, the second computing device comprises: a wireless interface configured to communicate with the neighboring device; one or more processors; and a memory having program instructions stored therein, the program instructions being executable by the one or more processors to cause the second computing device to perform operations including: sending a request for user credentials to the first computing device; instructing the neighboring device to send a location beacon to the first computing device, Wherein, the first computing device is arranged to: determining, based on the location beacon, whether to request user input to select the requested user credentials based on a threshold distance between the neighboring device and the first computing device; and In response to the first computing device determining that user input is requested based on the location beacon, the selected user credentials are sent to the second computing device.

12. The system of claim 11, wherein the operations performed by the second computing device include: presenting an authentication prompt requesting the user credentials to authenticate the user; as well as One or more fields in the authentication prompt are populated with user credentials transmitted by the first computing device.

13. The system of claim 12, wherein the operations performed by the second computing device include: receiving input from the neighboring device; determining that the input is a selection of a field within the authentication prompt; In response to the determination: sending the request for the user credentials to the first computing device; and Instruct the neighboring device to send the positioning beacon.

14. The system of claim 13, wherein the operations performed by the second computing device include: presenting a prompt specifying a value for the user to enter into the second computing device to authenticate the second computing device; as well as In response to the user entering the value into the second computing device, a secure channel is established with the second computing device to receive the selected user credentials.

15. The system of claim 12, wherein the operations performed by the second computing device include: executing an application associated with a streaming service, wherein the authentication prompt is usable to authenticate the user to the streaming service; as well as An indication of the application is sent to the first computing device to cause the first computing device to suggest user credentials associated with the application for selection by the user.

16. The system of claim 12, wherein the operations performed by the second computing device include: Presenting a web page including the authentication prompt; as well as An indication of a domain name associated with the webpage is sent to the first computing device so that the first computing device suggests user credentials associated with the domain name for selection by the user.

17. The system of claim 12, wherein the operations performed by the second computing device include: In response to receiving the selected user credentials, the contents of the populated one or more fields are automatically submitted to the authentication service.

18. A method for sharing credentials, comprising: a remote controller for a media player device receiving a request to broadcast a location beacon associated with a credential request sent by the media player device for an authentication prompt presented on a display by the media player device; as well as In response to the request, the remote controller broadcasts the location beacon to the mobile device, wherein the location beacon can be used by the mobile device to determine whether to respond to the credential request by providing user-selected credentials to the media player device for input into one or more fields of the authentication prompt.

19. The method of claim 18, wherein the mobile device determines proximity to the remote controller using a signal strength associated with the broadcast location beacon, and wherein the mobile device determines whether to prompt a user to select the credential based on the determined proximity.

20. The method of claim 18, further comprising: the remote controller receiving input from a user selecting an authentication field in the authentication prompt; as well as The remote controller sends an indication of the input to the media player device, wherein the request to broadcast the location beacon is received in response to sending the indication of the input.

Images