Techniques for device-to-device authentication

Abstract

This disclosure describes techniques for device-to-device authentication. For example, a first device may detect a second device, such as when a user physically attaches the second device to the first device or when the second device wirelessly communicates with the first device. Then, components of the first device and / or an authentication entity may determine to authenticate the second device. In some instances, the component determines to authenticate the second device using information associated with the environment of the second device. To authenticate the second device, the authentication entity may send a request to the user, receive a response from the user, and then verify the response. After authentication, the first device may determine that the second device includes a trusted device and establish a connection with the second device.

Description

[0001] Related applications

[0002] This application claims priority to U.S. Patent Application No. 16 / 712,775, filed December 12, 2019, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure generally relates to the use of certification entities to certify devices. Background Technology

[0004] There are many instances where devices attempt to connect to each other to send and receive data. For example, if a user attaches a first device to a second device, such as by plugging a Universal Serial Bus (USB) device into a computer, the first device will attempt to establish a mechanical connection with the second device. A second example is when a first device attempts to connect wirelessly to a second device, for instance, if the second device includes a network device (e.g., a router) that provides network access to the first device; in this case, the first device will attempt to establish a wireless connection. However, problems can arise when devices attempt to connect to each other without a user establishing that connection. For example, a device attempting to connect to another device might not be trusted by the user of that other device. Attached Figure Description

[0005] The specific embodiments are described below with reference to the accompanying drawings. In the drawings, the leftmost number(s) of the reference numerals indicate the drawing in which that reference numeral first appears. The same reference numerals are used in different drawings to indicate similar or identical items. In some cases, parentheses are used after the reference numerals to distinguish similar elements. The use of reference numerals without associated parentheses is general for that element. The systems shown in the drawings are not drawn to scale, and the components in the drawings may be drawn to scale relative to each other.

[0006] Figure 1 A component diagram of a first example environment in which a cloud authentication concept may be adopted according to the concepts of this application is shown.

[0007] Figure 2 A component diagram of a second example environment in which a cloud authentication concept may be adopted according to the concepts of this application is shown.

[0008] Figure 3 A flowchart is shown for a first example method of authenticating electronic devices using an authentication entity.

[0009] Figure 4 A flowchart is shown for a second example method for authenticating electronic devices using an authentication entity.

[0010] Figure 5A flowchart is shown for a third example method for authenticating electronic devices using an authentication entity.

[0011] Figure 6 A computing system diagram is shown, illustrating the configuration of a data center that can be used to implement various aspects of the techniques disclosed herein.

[0012] Figure 7 This is a computer architecture diagram illustrating an illustrative computer hardware architecture for implementing server computing devices that can be used to implement various aspects of the various technologies presented herein. Detailed Implementation

[0013] Overview

[0014] Various aspects of the invention are set forth in the independent claims, and preferred features are set forth in the dependent claims. A feature of one aspect may be applied to any aspect alone or in combination with other aspects.

[0015] This disclosure describes at least in part a first electronic device configured to detect a second electronic device and use components of a communication stack to determine whether to authenticate the second electronic device using an authentication service. The first electronic device is also configured to send a request for authentication of the second electronic device to one or more devices associated with the authentication service. Furthermore, the first electronic device is configured to receive an indication from one or more devices that the second electronic device has been authenticated.

[0016] This disclosure also describes, at least in part, a method comprising: a first electronic device detecting that a second electronic device is attempting to establish a direct connection with the first electronic device; the method further comprising: the first electronic device determining to use an authentication service to authenticate the second electronic device; and the method comprising: sending a request to authenticate the second electronic device to one or more devices associated with the authentication service; and receiving an indication from one or more devices that one or more devices have authenticated the second electronic device.

[0017] This disclosure also describes, at least in part, a first electronic device configured to store first information representing a first state of the environment of a second electronic device. The first electronic device is also configured to receive second information representing a second state of the environment of the second electronic device. Furthermore, the first electronic device is configured to determine, at least in part, to authenticate the second electronic device based on the first and second information, and to send a request for authentication of the second electronic device to one or more devices associated with an authentication service.

[0018] Example Implementation

[0019] This disclosure describes, at least in part, techniques that can be implemented by an electronic device coupled to an authentication entity and one or more other electronic devices. For example, the electronic device can use the authentication entity to authenticate (one or more) other electronic devices as (one or more) trusted devices. This can occur when the electronic device detects that (one or more) other electronic devices are attempting to establish a connection with (one or more) the electronic device. In some instances, the authentication entity can use multi-factor authentication to authenticate (one or more) other electronic devices. For example, after receiving a request to authenticate another electronic device, the authentication entity can send an authentication request to a user associated with that electronic device. The authentication entity can then receive a response to the authentication request from the user device. After determining that the response is valid, the authentication entity can send an indication to the electronic device that the other electronic device is trusted. Thus, the electronic device is able to authenticate (one or more) other electronic devices, for example, when (one or more) other electronic devices attempt to establish a connection with (one or more) the electronic device.

[0020] More specifically, an electronic device (which may be referred to as the "first electronic device" in these examples) can detect a second electronic device. In some instances, the first electronic device detects the second electronic device based on the second electronic device attempting to establish a mechanical connection with the first electronic device. For example, if the second electronic device includes a Universal Serial Bus (USB) device, the first electronic device can detect the second electronic device based on the second electronic device being plugged into the first electronic device's USB port. Alternatively, in some instances, the first electronic device can detect the second electronic device based on the second electronic device attempting to establish a wireless connection with the first electronic device. For example, if the first electronic device includes a network device such as a router, the first electronic device can detect the second electronic device based on the second electronic device sending a request to establish a wireless connection.

[0021] In some instances, a first electronic device can receive account data from a second electronic device. For example, when the first electronic device includes a network device, it can receive account data (e.g., credentials) from the second electronic device. The first electronic device can then attempt to use the credentials to initially authenticate the second electronic device. For instance, the first electronic device can match the credentials with stored credentials associated with a user account. Based on this match, the first electronic device can initially authenticate the second electronic device.

[0022] In some instances, the first electronic device may include a component that determines when to use an authentication entity to authenticate the second electronic device as a trusted electronic device. In some instances, the component may include software placed within the communication stack of the first electronic device, which is used to communicate with the second electronic device. For example, if the second electronic device includes a USB device, the component may include software placed within a device driver associated with the USB port. In some instances, the component is placed within one or more layers of the communication stack of the first electronic device. For example, the component may be placed within a first, second, third, fourth, and / or fifth layer associated with the communication stack.

[0023] For example, the component can be placed within the physical layer (e.g., layer 1), data link layer (e.g., layer 2), network layer (e.g., layer 3), transport layer (e.g., layer 4), session layer (e.g., layer 5), presentation layer (e.g., layer 6), and / or application layer (e.g., layer 7) of the communication stack. In some instances, the component is placed within a layer associated with information of the type for which it is configured to analyze. For example, if the component is configured to analyze information about a network being used by a second electronic device, it can be placed within the second layer of the communication stack.

[0024] The first electronic device may use this component to determine whether to authenticate the second electronic device using an authentication entity. In some instances, the component may determine whether to authenticate the second electronic device each time the first electronic device detects the second electronic device. Alternatively or additionally, in some instances, the first electronic device may use one or more characteristics associated with the environmental state of the second electronic device to determine whether to authenticate the second electronic device. As described herein, one or more characteristics may include, but are not limited to: a unique device identifier associated with the second electronic device, hardware associated with the second electronic device (e.g., hardware installed on the second electronic device), software installed on the second electronic device, one or more applications active on the second electronic device, central processing unit (CPU) utilization associated with the second electronic device, memory utilization associated with the second electronic device, addresses associated with the second electronic device (e.g., Media Access Control (MAC) address, Internet Protocol (IP) address, etc.), power consumption associated with the second electronic device, type of network connection (e.g., mechanical, wireless, etc.), one or more other devices with which the second electronic device is communicating (e.g., via Bluetooth, WiFi, etc.), sensor data representing the user of the second electronic device, and / or the location of the second electronic device, etc.

[0025] For example, a first electronic device can receive information representing one or more characteristics from a second electronic device. The component can then analyze these characteristics to determine whether to use an authentication entity to authenticate the second electronic device. In some instances, the component can determine to authenticate the second electronic device based on the determination that the second electronic device includes a new electronic device to which the first electronic device has not previously connected. For a first example, the component can determine to authenticate the second electronic device based on information representing a new address (e.g., a new MAC address, a new IP address, etc.). For a second example, the component can determine to authenticate the second electronic device based on information representing a new identifier (e.g., a new unique device identifier).

[0026] Alternatively or concurrently, in some instances, the component may determine authentication of the second electronic device based on transitions associated with the environment of the second electronic device. For example, the first electronic device may store information representing one or more previous characteristics associated with a previous state of the environment of the second electronic device. The component may then compare the one or more characteristics associated with the environment represented by the received information with one or more previous characteristics associated with the environment. Based on this comparison, the component may identify one or more transitions between the current state of the environment and one or more previous states of the environment. As described herein, such transformation(s) may include, but are not limited to: changes in a unique device identifier, changes in hardware associated with the second electronic device, changes in software installed on the second electronic device, changes in one or more applications active on the second electronic device, changes in CPU utilization associated with the second electronic device, changes in memory utilization associated with the second electronic device, changes in addresses associated with the second electronic device, changes in power consumption associated with the second electronic device (e.g., whether the second electronic device was continuously receiving power, or whether the second electronic device stopped receiving power for a period of time (or more periods of time)), changes in the type of network connection associated with the second electronic device, changes in the user of the second electronic device (as determined using sensor data), changes in the location of the second electronic device, and / or any other state change.

[0027] The component can then use the transition(s) to determine whether to use an authentication entity to re-authenticate the second electronic device. A first example is that if the transition(s) indicates that the current state of the environment is similar to one or more previous states of the environment, the component can determine that an authentication entity should not be used to re-authenticate the second electronic device. In some instances, the component can determine that the transition(s) indicates that the current state of the environment is similar to one or more previous states of the environment when there are only small differences between the compared characteristics(s). For example, if the transition(s) indicates only a small change in CPU utilization (e.g., 1%, 5%, 10%, etc.) and / or a small change in memory utilization (e.g., 1%, 5%, 10%, etc.), the component can determine that the current state of the environment is similar to one or more previous states of the environment. Furthermore, if the transition(s) only indicates that a new software application is activated on the second electronic device, the component can determine that the current state of the environment is still similar to one or more previous states of the environment.

[0028] A second example is that if the transition(s) indicate that the current state of the environment differs from one or more previous states of the environment, the component can determine that an authentication entity should be used to re-authenticate the second electronic device. In some instances, the component can determine that the transition(s) indicate that the current state of the environment differs from one or more previous states of the environment when there are significant differences between the compared characteristics(s). For example, if the transition(s) indicate a significant change in CPU utilization (e.g., 75%, 80%, 90%, etc.) and / or a significant change in memory utilization (e.g., 75%, 80%, 90%, etc.), the component can determine that the current state of the environment differs from one or more previous states of the environment. Additionally, if the transition(s) indicate that the second electronic device is using a new IP address and / or has a new unique device identifier, the component can similarly determine that the current state of the environment differs from one or more previous states of the environment.

[0029] In some instances, the component can analyze this information to identify “triggering events” associated with the environment of the second electronic device. As described herein, triggering events may include, but are not limited to, malicious hardware / software (e.g., malware) identified on the second electronic device, changes to unique device identifiers, changes to IP addresses, changes to MAC addresses, insecure network connections, etc. In some instances, when the component identifies a triggering event, it can determine to re-authenticate the second electronic device using an authentication entity.

[0030] In some instances, when a transition(s) are identified, the component can use one or more machine learning models to identify the transition(s) associated with the current state of the environment. For example, the machine learning models(s) can be configured to analyze one or more characteristics associated with the environment of the second electronic device, such as whenever the component determines that characteristic(s). Based on this analysis, the machine learning models(s) identify (e.g., learn) one or more characteristics that remain substantially constant. For example, the machine learning models(s) could identify that the second electronic device typically uses the same address, typically uses the same unique device identifier, includes CPU usage falling within a given range, includes one or more applications typically active on the user device, etc. The component can then compare the new characteristics(s) with the learned characteristics(s) to identify the transition(s). When a transition(s) is identified using the machine learning models(s), that transition(s) can correspond to an “anomaly” in the second electronic device.

[0031] In some instances, to authenticate a second electronic device, a first electronic device may send an authentication request to an authentication entity. In some instances, this request may include at least a portion of information received from the second electronic device. The authentication entity may then perform multi-factor authentication to authenticate the second electronic device. For example, the authentication entity may generate an authentication request. As described herein, the authentication request may include, but is not limited to, codes, questions, passwords, push notifications, and / or any other factors that may be used to authenticate the second electronic device. The authentication entity may then send the authentication request to the user associated with the first electronic device (e.g., via email, messages, applications, push notifications, etc.).

[0032] Based on sending an authentication request, the authentication entity can receive a response to the authentication request from the first electronic device and / or another electronic device associated with the user. The authentication entity can then determine whether the response is valid for the authentication request. For example, if the authentication request includes a code that the user must enter to authenticate the second electronic device, the response can include that code. Thus, when the code entered by the user includes the same code as in the authentication request, the authentication entity can determine that the response is valid. After authenticating the second electronic device, the authentication entity can send authentication data to the first electronic device indicating that the second electronic device has been authenticated.

[0033] In some instances, authentication data may include tokens, cookies, and / or other types of data used by the first electronic device to determine that the second electronic device is trusted. In some instances, authentication data may include a duration for which the authentication entity verifies that the second electronic device can be trusted for that duration. As described herein, the duration may include, but is not limited to, an hour, a day, a week, and / or any other time period. In some instances, the authentication entity uses one or more transitions to determine the duration of the authentication data.

[0034] The first example is that if one or more transitions indicate that the current state of the environment is similar to one or more previous states of the environment, the authentication entity can determine the duration by adding the previous duration associated with the previous session when the authentication entity authenticates the second electronic device. In some instances, the greater the similarity between the current state of the environment and one or more previous states of the environment, the greater the increase used by the authentication entity in determining the duration. The second example is that if one or more transitions indicate that the current state of the environment is different from one or more previous states of the environment, the authentication entity can determine the duration by subtracting the previous duration associated with the previous session when the authentication entity authenticates the second electronic device. In some instances, the greater the difference between the current state of the environment and one or more previous states of the environment, the greater the decrease used by the authentication entity in determining the duration.

[0035] While the above example describes a component of the first electronic device determining whether to authenticate the second electronic device, in other examples, the authentication entity may perform a similar process to determine whether to authenticate the second electronic device. For example, based on the first electronic device detecting the second electronic device and / or receiving information from the second electronic device, the first electronic device may send the information to the authentication entity. The authentication entity may then perform the process described above (refer to the component) to determine whether to authenticate the second electronic device. In some instances, when the authentication entity determines that the second electronic device should be authenticated, the authentication entity may perform the authentication process described above and send authentication data to the first electronic device. In some instances, when the authentication entity determines that the second electronic device should not be authenticated, the authentication entity may send an indication to the first electronic device that the second electronic device does not need to be authenticated.

[0036] In some instances, based on the determination that the second electronic device does not need to be authenticated and / or receive authentication data from the authentication entity, the first electronic device can establish a connection with itself (e.g., a mechanical connection, a wireless connection, etc.). The first and second electronic devices can then use this connection to communicate with each other. For example, the first electronic device can use this connection to send data to and / or receive data from the second electronic device. In some instances, the first electronic device can continue to trust the second electronic device until the duration associated with the authentication data expires. For example, once the duration expires, the first electronic device (and / or component) can determine to re-authenticate the second electronic device.

[0037] By executing the process described here, the first electronic device can determine whether to authenticate the second electronic device, even without user input. This can provide greater security for devices communicating with each other, especially when the communication involves device-to-device communication. For example, before the first electronic device sends data to and / or receives data from the second electronic device (e.g., in addition to data sent by the second electronic device in an attempt to establish a connection), the first electronic device determines that the second electronic device is a trusted device. Furthermore, by using multi-factor authentication to authenticate the second electronic device, the user of the first electronic device can be required to verify that the second electronic device is trusted before the first electronic device establishes a connection with the second electronic device.

[0038] While the examples described herein may refer to electronic devices and / or authentication entities as multi-party cloud authentication systems participating in a cloud networking environment, these technologies can generally be applied to any device or role, including enterprise employee scenarios. Furthermore, these technologies are generally applicable to any network of devices managed by any entity providing virtual resources. In some instances, these technologies can be implemented via Software-Defined Networking (SDN), and in other examples, a variety of devices can be used in the system to implement the technologies described herein. The user device implementing these technologies herein is one implementation, and the technologies described are not limited to any particular architecture or implementation.

[0039] The techniques described herein offer various improvements and efficiencies in network communication. For example, they can reduce computing resource usage, storage, data loss, latency, and other problems experienced in a network due to a lack of network resources, overuse of network resources, timing issues in network communication, and / or incorrect data routing. By improving network communication on the network, the overall performance of servers and virtual resources can be improved.

[0040] Certain implementations and embodiments of this disclosure will now be described more fully below with reference to the accompanying drawings, in which various aspects are illustrated. However, these aspects may be implemented in many different forms and should not be construed as limited to the implementations set forth herein. This disclosure includes variations of the embodiments as described herein. The same reference numerals denote the same elements throughout.

[0041] Figure 1 A first example environment 100 according to the cloud authentication concept of this application is shown. Example environment 100 may include a cloud computing network 102 (e.g., a network), one or more user devices 104, electronic devices 106, and / or one or more authentication devices 108 (e.g., authentication entities). Parentheses are used after reference numbers to distinguish similar elements. The use of reference numbers without associated parentheses is general for that element. For example, Figure 1 Two instances of user equipment 104 are included: user equipment 104(1) which can represent a desktop computer and user equipment 104(2) which can represent a mobile phone. In some scenarios, multiple user equipment 104 may be associated with a single user. One or more authentication devices 108 may provide remote online services, which user equipment 104 may use to authenticate other devices.

[0042] In some examples, environment 100 includes a data center or cloud computing network that includes servers and other network components (e.g., routers, switches, etc.) stored across multiple data centers located in multiple geographic regions. In these instances, the cloud computing environment can be a distributed network through which multiple devices interact with services provided by the cloud computing network. The cloud computing network can provide on-demand availability of computing system resources (e.g., data storage, computing power (e.g., CPUs, GPUs, etc.), networking, databases, etc.) without requiring direct, active management by the user. In some examples, the cloud computing network can be managed and maintained by a service provider, so users do not need to invest in and maintain computing infrastructure for their computing resource needs.

[0043] One or more user devices 104 and / or one or more authentication devices 108 may be communicatively coupled to each other and / or coupled to various other devices via cloud computing network 102. Within example environment 100, user devices 104, authentication devices 108, and / or other devices may exchange communication (e.g., packets) with cloud computing network 102 via one or more network connections, as indicated by double arrows 110. For example, network connection 110 may be a Transmission Control Protocol (TCP) network connection or any network connection that enables devices to exchange packets with other devices via cloud computing network 102 (e.g., Information Center Networking (ICN)). Network connection 110 represents, for example, a data path between user device 104 and one or more authentication devices 108. For example, user device 104 may be a computer, laptop computer, mobile device, tablet computer, etc., while one or more authentication devices 108 may be configured to provide data and / or network services to user device 104. One or more authentication devices 108 may or may not be a producer, generation point, and / or origin of data. For example, data may originate from other locations that authentication device(s) 108 can provide to user device(s) 104. Alternatively or concurrently, data may travel along the path from authentication device(s) 108 to user device(s) 104 via other network devices (e.g., routers, switches). It should be understood that the term "network connection" can also be referred to as "network path." The use of a cloud computing network in this example is not intended to be restrictive. Other types of networks are envisioned based on the multi-party cloud authentication concept.

[0044] In “Step 1”, user equipment 104(1) may communicate with electronic device 106. Communication at Step 1 may include: a person inserting electronic device 106 into an input interface 112 (e.g., a device port) associated with user equipment 104(1). In some instances, authentication component 114 may then determine whether to authenticate electronic device 106 using authentication device(s) 108(1). In some instances, authentication component 114 may determine to authenticate electronic device 106 each time user equipment 104(1) detects electronic device 106. Alternatively or additionally, in some instances, authentication component 114 may use one or more characteristics 116 associated with the state of the environment of electronic device 106 to determine whether to authenticate electronic device 106.

[0045] For example, user equipment 104(1) can receive information 118 from electronic device 106 representing one or more characteristics 116 associated with the state of the environment. Authentication component 114 can then analyze one or more characteristics 116 to determine whether to use authentication device 108 to authenticate electronic device 106. In some instances, authentication component 114 can determine to authenticate electronic device 106 based on determining that electronic device 106 includes a new electronic device to which user equipment 104(1) has not previously connected. A first example is that authentication component 114 can determine to authenticate electronic device 106 based on information 118 representing a new address (e.g., a new MAC address, a new IP address, etc.). A second example is that authentication component 114 can determine to authenticate electronic device 106 based on information 118 representing a new identifier (e.g., a new unique device identifier).

[0046] Alternatively or concurrently, in some instances, authentication component 114 may determine whether to authenticate electronic device 106 based on one or more transitions 120 associated with the environment of electronic device 106. For example, user equipment 104(1) may store information 118 representing one or more previous characteristics 116 associated with a previous state of the environment of electronic device 106. Authentication component 114 may then compare the one or more characteristics 116 associated with the environment (as represented by the received information 118) with the one or more previous characteristics 116 associated with the environment. Based on this comparison, authentication component 114 may identify one or more transitions 120 between the current state of the environment and the one or more previous states of the environment. Authentication component 114 may then use the one or more transitions 120 to determine whether to re-authenticate electronic device 106 using authentication device 108.

[0047] The first example is that if transition(s) 120 indicate that the current state of the environment is similar to one or more previous states of the environment, then authentication component 114 can determine that it will not use authentication device(s) 108 to re-authenticate electronic device 106. As described above, when there is a small difference between the compared characteristics(s) 116, authentication component 114 can determine that transition(s) indicate that the current state of the environment is similar to one or more previous states of the environment. The second example is that if transition(s) 120 indicate that the current state of the environment is different from one or more previous states of the environment, then authentication component 114 can determine that it will use one or more authentication devices 108 to re-authenticate electronic device 106. As described above, when there is a large difference between the compared characteristics(s) 116, authentication component 114 can determine that transition(s) 120 indicate that the current state of the environment is different from one or more previous states of the environment.

[0048] In “Step 2”, user equipment 104(1) may communicate with one or more authentication devices 108. The communication at Step 2 may include: user equipment 104(1) sending a request 122 to one or more authentication devices 108 to authenticate electronic device 106. In some instances, the communication at Step 2 may also include: user equipment 104(1) sending at least a portion of information 118 to one or more authentication devices 108. One or more authentication devices 108 may receive at least a portion of request 122 and / or information 118 from user equipment 104(1) and authenticate electronic device 106 for user equipment 104(1). In some instances, one or more authentication devices 108 may perform multi-factor authentication to authenticate user equipment 104(1).

[0049] For example, at “Step 3”, one or more authentication devices 108 may communicate with user device 104 (2). Communication at Step 3 may include providing authentication request 124 to user device 104 (2) via a type of communication (e.g., via email, message, app, push notification, etc.). User device 104 (2) may then receive one or more inputs representing a response 126 to authentication request 124. A first example is that if authentication request 124 includes a code sent to the user via email, response 126 may include that code. A second example is that if authentication request 124 includes a question to the user, response 126 may include an answer to that question. Furthermore, a third example is that if authentication request 124 includes a push notification, response 126 may include the user selecting an interface element (e.g., a button) associated with the push notification. In either example, user device 104 (2) may then send response 126 back to one or more authentication devices 108.

[0050] One or more authentication devices 108 can then use response 126 to authenticate electronic device 106. For example, one or more authentication devices 108 can determine that response 126 to authentication request 124 is correct. One or more authentication devices 108 can then generate authentication data 128 (e.g., tokens and / or cookies, etc.) indicating that one or more authentication devices 108 has authenticated electronic device 106. In some instances, authentication data 128 includes at least the duration for which electronic device 106 has been authenticated. For example, after the duration has expired, user device 104(1) can use one or more authentication devices 108 to re-authenticate electronic device 106.

[0051] In “Step 4”, one or more authentication devices 108 may communicate with user equipment 104(1). The communication at Step 4 may include: one or more authentication devices 108 sending authentication data 128 to user equipment 104(1). User equipment 104(1) can then use the authentication data 128 to determine that one or more authentication devices 108 have authenticated electronic device 108. Thus, user equipment 104(1) can determine that a connection with electronic device 106 has been established. Alternatively or additionally, in some instances, user equipment 104(1) may begin sending data to and / or receiving data from electronic device 106.

[0052] In some instances, authentication component 114 may include software placed within one or more communication stacks 130 of user equipment 104(1), wherein the communication stack(s) 130 is used to communicate with at least electronic device 106. For example, if electronic device 106 includes a USB device, authentication component 114 may include software placed within a device driver associated with the USB port. In some instances, authentication component 114 is placed within one or more layers of communication stack(s) 130. For example, authentication component 114 may be placed within a first, second, third, fourth, and / or fifth layer, etc., associated with communication stack(s) 130. In some instances, authentication component 114 is placed within a layer of communication stack 130 associated with the type of feature 116 that authentication component 114 is analyzing to determine whether to authenticate electronic device 106.

[0053] like Figure 1 As further illustrated in the example, user equipment 104(1) includes one or more processors 132 and memory 134, authentication device 108 includes one or more processors 136 and memory 138, and user equipment 104(2) includes one or more processors 140 and memory 142. As used herein, a processor may include multiple processors and / or a processor having multiple cores. Furthermore, a processor may include one or more cores of different types. For example, a processor may include an application processor unit, a graphics processing unit, etc. In one instance, a processor may include a microcontroller and / or a microprocessor. One or more processors may include a graphics processing unit (GPU), a microprocessor, a digital signal processor, or other processing units or components known in the art. Alternatively or additionally, the functions described herein may be performed at least in part by one or more hardware logic components. Examples of hardware logic components that may be used, such as but not limited to, include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SOCs), complex programmable logic devices (CPLDs), etc. In addition, (one or more) processors may have their own local memory, which may also store program components, program data and / or one or more operating systems.

[0054] Memory can include volatile and non-volatile memory, removable and non-removable media, implemented in any way or by any technology to store information (e.g., computer-readable instructions, data structures, program components, or other data). Memory includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage devices, magnetic tape cassettes, magnetic tape, disk storage devices or other magnetic storage devices, RAID storage systems, or any other medium that can be used to store desired information and can be accessed by a computing device. Memory can be implemented as a computer-readable storage medium (“CRSM”), which can be any available physical medium accessible by one or more processors to execute instructions stored on the memory. In one basic example, CRSM can include random access memory (“RAM”) and flash memory. In other examples, CRSM can include, but is not limited to, read-only memory (“ROM”), electrically erasable programmable read-only memory (“EEPROM”), or any other tangible medium that can be used to store desired information and can be accessed by one or more processors.

[0055] Figure 2 A second example environment 200 according to the cloud authentication concept of this application is shown. The example environment 200 may include a cloud computing network 102 (e.g., a network), one or more user devices 104, electronic devices 202, and / or one or more authentication devices 108 (e.g., authentication entities).

[0056] One or more user devices 104, electronic devices 202, and / or one or more authentication devices 108 may communicatively couple to each other and / or to various other devices via cloud computing network 102. Within example environment 200, user devices 104, electronic devices 202, authentication devices 108, and / or other devices may exchange communication (e.g., packets) with cloud computing network 102 via one or more network connections, as indicated by double arrows 204. For example, network connection 204 may be a Transmission Control Protocol (TCP) network connection or any network connection that enables devices to exchange packets with other devices via cloud computing network 102 (e.g., Information Center Networking (ICN)). Network connection 204 represents, for example, a data path between user devices 104, electronic devices 202, and one or more authentication devices 108. For example, user device 104 may be a computer, laptop computer, mobile device, tablet computer, etc., while one or more authentication devices 108 may be configured to provide data and / or network services to user device 104. One or more authentication devices 108 may or may not be a producer, generation point, and / or source of data. For example, data may originate from other locations that authentication device(s) 108 can provide to user device(s) 104. Alternatively or concurrently, data may travel along the path from authentication device(s) 108 to user device(s) 104 via other network devices (e.g., routers, switches). It should be understood that the term "network connection" can also be referred to as "network path." The use of a cloud computing network in this example is not intended to be restrictive. Other types of networks are envisioned based on the multi-party cloud authentication concept.

[0057] In “Step 1”, user equipment 104(1) may communicate with electronic device 202. The communication at Step 1 may include: user equipment 104(1) attempting to establish a connection with electronic device 202. For example, electronic device 202 may include a network device, such as a router. To establish a connection, electronic device 202 may receive credentials 206 from user equipment 104(1). Credentials 206 may include, but are not limited to, an identifier (e.g., a service set identifier) ​​and a password. Electronic device 202 can then use credentials 206 to perform initial authentication of user equipment 104(1). For example, electronic device 202 may match credentials 206 against stored credentials associated with a user account. Based on this match, electronic device 202 may initially authenticate user equipment 104(1).

[0058] In some instances, authentication component 208 may then determine whether to use authentication device(s) 108(s) to further authenticate user equipment 104(1). In some instances, authentication component 208 may determine to further authenticate user equipment 104(1) each time user equipment 104(1) attempts to connect to electronic device 202. Alternatively or additionally, in some instances, authentication component 208 may use one or more characteristics 210 associated with the environmental state of user equipment 104(1) to determine whether to authenticate user equipment 104(1).

[0059] For example, electronic device 202 may receive information 212 from user device 104(1) representing one or more characteristics 210 associated with the state of the environment. Authentication component 208 may then analyze one or more characteristics 210 to determine whether to use authentication device 108 to authenticate user device 104(1). In some instances, authentication component 208 may determine to authenticate user device 104(1) based on determining that user device 104(1) includes a new electronic device to which electronic device 202 has not previously been connected. A first example is that authentication component 208 may determine to authenticate user device 104(1) based on information 212 representing a new address (e.g., a new MAC address, a new IP address, etc.). A second example is that authentication component 208 may determine to authenticate user device 104(1) based on information 212 representing a new identifier (e.g., a new unique device identifier).

[0060] Alternatively or concurrently, in some instances, authentication component 208 may determine whether to authenticate user equipment 104(1) based on one or more transitions 214 associated with the environment of user equipment 104(1). For example, electronic device 202 may store information representing one or more previous characteristics 210 associated with a previous state of the environment of user equipment 104(1). Authentication component 208 may then compare the one or more characteristics 210 associated with the environment (as indicated by received information 212) with the one or more previous characteristics 210 associated with the environment. Based on this comparison, authentication component 208 may identify one or more transitions 214 between the current state of the environment and the one or more previous states of the environment. Authentication component 208 may then use one or more transitions 214 to determine whether to re-authenticate user equipment 104(1) using authentication device 108.

[0061] The first example is that if transition(s) 214 indicate that the current state of the environment is similar to one or more previous states of the environment, then authentication component 208 can determine that user equipment 104(1) should not be re-authenticated using authentication device(s) 108. As described above, authentication component 208 can determine that transition(s) 214 indicates that the current state of the environment is similar to one or more previous states of the environment when there is a small difference between the compared features(s) 210. The second example is that if transition(s) 214 indicate that the current state of the environment is different from one or more previous states of the environment, then authentication component 208 can determine that user equipment 104(1) should be re-authenticated using authentication device(s) 108. As described above, authentication component 208 can determine that transition(s) 214 indicates that the current state of the environment is different from one or more previous states of the environment when there is a large difference between the compared features(s) 210.

[0062] In “Step 2”, electronic device 202 may communicate with one or more authentication devices 108. The communication at Step 2 may include: electronic device 202 sending a request 216 to one or more authentication devices 108 to authenticate user equipment 104(1). In some instances, the communication at Step 2 may also include: electronic device 202 sending at least a portion of information 212 to one or more authentication devices 108. One or more authentication devices 108 may receive at least a portion of request 216 and / or information 212 from electronic device 202 and authenticate user equipment 104(1) for electronic device 202. In some instances, one or more authentication devices 108 may perform multi-factor authentication to authenticate user equipment 104(1).

[0063] For example, in “Step 3”, one or more authentication devices 108 may communicate with user device 104 (2). Communication at Step 3 may include providing authentication request 218 to user device 104 (2) via a type of communication (e.g., via email, message, app, push notification, etc.). User device 104 (2) may then receive one or more inputs representing a response 220 to authentication request 218. A first example is that if authentication request 218 includes a code sent to the user via email, response 220 may include that email-sent code. A second example is that if authentication request 218 includes a question for the user, response 220 may include an answer to that question. Furthermore, a third example is that if authentication request 218 includes a push notification, response 220 may include the user selecting an interface element (e.g., a button) associated with the push notification. In either example, user device 104 (2) may then send response 220 back to one or more authentication devices 108.

[0064] One or more authentication devices 108 can then use response 220 to authenticate user device 104(1). For example, one or more authentication devices 108 can determine that response 220 to authentication request 218 is correct. One or more authentication devices 108 can then generate authentication data 222, such as a token, cookie, etc., indicating that authentication device 108 has authenticated user device 104(1). In some instances, authentication data 222 includes at least the duration for which user device 104(1) was authenticated. For example, after the duration has expired, electronic device 202 can use one or more authentication devices 108 to re-authenticate user device 104(1).

[0065] In “Step 4”, one or more authentication devices 108 may communicate with electronic device 202. The communication at Step 4 may include: one or more authentication devices 108 sending authentication data 222 to electronic device 202. Electronic device 202 can then use the authentication data 222 to determine that one or more authentication devices 108 have authenticated user device 104 (1). Thus, electronic device 202 can determine to establish a connection with user device 104 (1). Alternatively or additionally, in some instances, electronic device 202 may begin sending data to and / or receiving data from user device 104 (1).

[0066] In some instances, authentication component 208 may include software placed within one or more communication stacks 224 of electronic device 202, wherein the communication stacks 224 are used to communicate at least with user device 104(1). In some instances, authentication component 208 is placed within one or more layers of the communication stacks 224. For example, authentication component 208 may be placed within a first, second, third, fourth, and / or fifth layer, etc., associated with the communication stacks 224.

[0067] like Figure 2 As further shown in the example, the electronic device 202 includes one or more processors 226 and memory 228.

[0068] It should be noted that Figure 1 and Figure 2 These are just two examples of when an electronic device can determine whether to authenticate another electronic device. However, a similar process can be performed when any other electronic device attempts to establish a physical and / or wireless connection with another device. For example, if an electronic device is attempting to establish a wireless connection with one or more other electronic devices (e.g., multiple Internet of Things (IoT) devices), it can perform a similar process to the one described above to authenticate one or more IoT devices.

[0069] Figure 3 A flowchart of a first example method 300 for authenticating an electronic device using an authentication entity is shown. Operation 302 indicates that an electronic device is detected. For example, a first electronic device (e.g., user device 104(1), electronic device 202, etc.) may use one or more techniques to detect a second electronic device. A first example is that the first electronic device may be detected based on the second electronic device being physically attached to the first electronic device (e.g., inserted into an input interface of the first electronic device). A second example is that the first electronic device may be detected based on receiving a request from the second electronic device to establish a connection with the first electronic device. In some instances, the request may also include credentials associated with a user account.

[0070] Operation 304 indicates a determination to use an authentication service to authenticate an electronic device. For example, a first electronic device may use an authentication component to determine whether to use the authentication service to authenticate a second electronic device. In some instances, this component is included in the communication stack associated with the first electronic device. In some instances, the component uses information received from the second electronic device to make this determination. A first example is that the component may determine to authenticate the second electronic device based on the fact that the first electronic device has not previously connected to the second electronic device. A second example is that the component may determine to authenticate the second electronic device based on one or more transitions associated with the environment of the second electronic device.

[0071] Operation 306 represents sending a request to one or more devices to authenticate the electronic device. For example, a first electronic device may send the request to one or more devices associated with an authentication service (e.g., authentication devices 108). In some instances, the first electronic device may also send at least a portion of information received from a second electronic device. The devices associated with the authentication service can then authenticate the second electronic device for the first electronic device. In some instances, the devices use multi-factor authentication to authenticate the second electronic device. For example, the devices may send an authentication request to a user associated with the first electronic device. The devices may then receive a response to the authentication request and use that response to authenticate the second electronic device.

[0072] Operation 308 indicates receiving an indication from one or more devices that the authentication service has authenticated an electronic device, and operation 310 indicates establishing a connection with the electronic device. For example, a first electronic device may receive authentication data from one or more devices associated with the authentication service, indicating that the authentication service has authenticated a second electronic device. In some instances, the authentication data may include the duration of the second electronic device's authentication. The first electronic device can then use the authentication data to determine that the second electronic device includes a trusted device. Thus, the first electronic device can establish a connection to transfer data between the first and second electronic devices.

[0073] Figure 4A flowchart is shown for a second example method 400 for authenticating an electronic device using an authentication entity. Operation 402 represents storing first information associated with the electronic device. For example, a first electronic device (e.g., user device 104(1), electronic device 202, etc.) may store first information associated with a second electronic device. In some instances, the first information represents one or more characteristics associated with one or more previous states of the environment(s) of the second electronic device, such as the state(s) of the environment(s) during one or more previous sessions when the second electronic device was authenticated for the first electronic device. In some instances, the first information represents one or more characteristics of the second electronic device(s) determined by the first electronic device using one or more machine learning models.

[0074] Operation 404 indicates that an electronic device has been detected. For example, the first electronic device may use one or more techniques to detect the second electronic device. A first example is that the first electronic device may detect the second electronic device based on the second electronic device being physically attached to the first electronic device (e.g., plugged into an input interface of the first electronic device). A second example is that the first electronic device may detect the second electronic device based on receiving a request from the second electronic device to establish a connection with the first electronic device. In some instances, the request may also include credentials associated with a user account.

[0075] Operation 406 indicates receiving second information associated with an electronic device. For example, the first electronic device may receive the second information based on the detection of a second electronic device. In some instances, the second information represents one or more characteristics associated with the current state of the environment of the second electronic device.

[0076] Operation 408 represents analyzing second information relative to first information. For example, a first electronic device may analyze second information relative to first information. In some instances, this analysis includes comparing one or more characteristics represented by the second information with one or more characteristics represented by the first information to determine whether one or more changes in the environmental state have occurred. As described herein, one or more changes may include, but are not limited to, changes in a unique device identifier, changes in hardware associated with the second electronic device, changes in software installed on the second electronic device, changes in one or more applications active on the second electronic device, changes in CPU usage associated with the second electronic device, changes in memory usage associated with the second electronic device, changes in addresses associated with the second electronic device, changes in power consumption associated with the second electronic device (e.g., whether the second electronic device continuously received power or whether the second electronic device stopped receiving power for a period of time), changes in the type of network connection associated with the second electronic device, changes in the user of the second electronic device (as determined using sensor data), changes in the location of the second electronic device, and / or any other state change.

[0077] Operation 410 indicates determining whether a triggering event has been detected. For example, a first electronic device may determine whether a triggering event has been detected based on this analysis. A first example is that the first electronic device may determine that a triggering event has been detected based on a transition indicating a change in an address (e.g., MAC address, IP address, etc.) associated with the second electronic device. A second example is that the first electronic device may determine that a triggering event has been detected based on a transition indicating a change in an identifier (e.g., a unique device identifier) ​​associated with the second electronic device. While these are just a few examples of triggering events that can be detected, in other examples, the first electronic device may detect additional and / or alternative triggering events.

[0078] If operation 410 determines that a triggering event has been detected, operation 412 indicates that the authentication service will be used to authenticate the electronic device. For example, if the first electronic device determines that a triggering event has been detected, the first electronic device can use the authentication service to authenticate the second electronic device. In some instances, to authenticate the second electronic device, the first electronic device may send a request to one or more devices associated with the authentication service (e.g., one or more authentication devices 108). In some instances, the first electronic device may also send at least a portion of the second information received from the second electronic device. The one or more devices associated with the authentication service can then authenticate the second electronic device for the first electronic device. In some instances, the one or more devices use multi-factor authentication to authenticate the second electronic device. The first electronic device can then receive an indication from the one or more devices that the authentication service has authenticated the second electronic device.

[0079] However, if operation 410 determines that no triggering event was detected, operation 414 indicates that the authentication service will not be used to authenticate the electronic device. For example, if the first electronic device determines that no triggering event was detected, it determines that it will not use the authentication service to authenticate the second electronic device. Instead, the first electronic device can establish a connection with the second electronic device, wherein the first and second electronic devices use the connection to send and receive data from each other.

[0080] It should be noted that, although Figure 4 The example describes the first electronic device as performing these operations, but in other examples, one or more authentication devices 108 may perform at least some of these operations. For example, based on the first electronic device detecting a second electronic device, the first electronic device may send second information to one or more authentication devices 108. The one or more authentication devices 108, which have already stored the first information, may then analyze the second information relative to the first information to determine whether a triggering event has been detected. If a triggering event is detected, the one or more authentication devices 108 may authenticate the second electronic device, for example, by using multi-factor authentication. However, if no triggering event is detected, the one or more authentication devices 108 may not authenticate the second electronic device. Instead, the one or more authentication devices 108 may send an indication to the first electronic device that the second electronic device includes a trusted device.

[0081] Figure 5A flowchart of a third example method 500 for authenticating an electronic device using an authentication entity is shown. Operation 502 represents receiving a request for authentication of a second electronic device from a first electronic device. For example, one or more authentication devices 108 may receive the request for authentication of the second electronic device from the first electronic device. In some instances, the authentication devices 108 receive the request based on the second electronic device attempting to communicate with the first electronic device. In some instances, the authentication devices 108 may also receive information representing the current state of the environment associated with the second electronic device.

[0082] Operation 504 indicates generating an authentication request, and operation 506 indicates sending the authentication request to the user. For example, one or more authentication devices 108 may generate an authentication request associated with authenticating a second electronic device. As described herein, the authentication request may include, but is not limited to, a code, a question, a password, a push notification, and / or any other factor that can be used to authenticate the second electronic device. The one or more authentication devices 108 may then send the authentication request to the user via email, a message, an application, and / or a push notification, etc.

[0083] Operation 508 indicates determining whether a response to the authentication request has been received. For example, one or more authentication devices 108 may determine whether a response has been received from the first electronic device and / or another electronic device. If operation 508 determines that no response has been received, operation 510 indicates sending an indication that the second electronic device is not authenticated. For example, if one or more authentication devices 108 have not received a response to the authentication request, then one or more authentication devices 108 may determine that the second electronic device is not authenticated. Thus, one or more authentication devices 108 may send an indication that the second electronic device is not authenticated to the first electronic device.

[0084] However, if operation 508 determines that a response has been received, operation 512 indicates whether the response is valid. For example, if authentication device(s)(108) receives a response, they can determine whether the response is valid. If operation 512 determines that the response is invalid, operation 510 similarly indicates sending an indication that the second electronic device is not authenticated. For example, if authentication device(s) ...

[0085] However, if operation 512 determines that the response is valid, then operation 514 indicates that an indication has been sent that the second electronic device has been authenticated. For example, if one or more authentication devices 108 determine that the response is valid, then one or more authentication devices 108 can authenticate the second electronic device. In this way, one or more authentication devices 108 can send an indication to the first electronic device that the second electronic device has been authenticated.

[0086] Figure 6 This is a computing system diagram illustrating the configuration of a data center 600 that can be used to implement various aspects of the techniques disclosed herein. Figure 6 The example data center 600 shown includes several computers 602A-602F (which may be referred to herein as "computer 602" in the singular or "multiple computers 602") for providing computing resources. In some examples, the resources and / or computers 602 may include or correspond to any type of networking device described herein, such as one or more authentication devices 108. However, computers 602 may include any type of networking device, such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, hosts, etc.

[0087] Computer 602 may be a standard tower, rack, or blade server computer appropriately configured to provide computing resources. In some examples, computer 602 may provide computing resources 604, including data processing resources such as virtual machine (VM) instances or hardware computing systems, database clusters, computing clusters, storage clusters, data storage resources, database resources, networking resources, etc. Some computers 602 may also be configured to execute resource manager 606, which is capable of instantiating and / or managing computing resources. For example, in the case of VM instances, resource manager 606 may be a super-supervisor or another type of program configured to enable the execution of multiple VM instances on a single computer 602. Computer 602 in data center 600 may also be configured to provide network services and other types of services.

[0088] exist Figure 6In the example data center 600 shown, computers 602A-602F are also interconnected using a suitable local area network (LAN) 608. It should be understood that the configuration and network topology described herein have been greatly simplified, and many more computing systems, software components, network and networking devices can be used to interconnect the various computing systems disclosed herein and provide the aforementioned functionality. Suitable load balancing devices or other types of network infrastructure components can also be used to balance the load among the computing resources between multiple data centers 600, between each computer 602A-602F in each data center 600, and potentially between each computer 602. This is intended to be illustrative only, and other implementations may be used.

[0089] In some examples, computer 602 may each execute one or more application containers and / or virtual machines to perform the techniques described herein. For example, containers and / or virtual machines may act as server devices, user devices, and / or routers in cloud computing network 102.

[0090] In some cases, data center 600 can provide computing resources persistently or on demand, such as application containers, VM instances, and storage devices. Computing resources provided by the cloud computing network can be used to implement the various services and technologies mentioned above, as well as other types of functions. Computing resources 604 provided by the cloud computing network can include various types of computing resources, such as data processing resources (e.g., application containers and VM instances), data storage resources, network resources, data communication resources, and network services.

[0091] Each type of computing resource 604 provided by the cloud computing network can be general-purpose or available in multiple specific configurations. For example, data processing resources can be used as physical computers or VM instances in a variety of different configurations. VM instances can be configured to run applications, including web servers, application servers, media servers, database servers, some or all of the aforementioned network services, and / or other types of programs. Data storage resources can include file storage devices and block storage devices, etc. The cloud computing network can also be configured to provide other types of computing resources 604 not specifically mentioned herein.

[0092] The computing resources 604 provided by the cloud computing network, in one embodiment, may be implemented by one or more data centers 600 (which may be referred to herein as "data center 600" in the singular or "multiple data centers 600" in the plural). A data center 600 is a facility for housing and operating computer systems and related components. A data center 600 typically includes redundant and backup power, communication, cooling, and security systems. Data centers 600 may also be located in geographically distinct locations. The following will refer to... Figure 7An illustrative embodiment of a data center 600 that can be used to implement the techniques disclosed herein is described.

[0093] Figure 7 This is a computer architecture diagram illustrating an illustrative computer hardware architecture for implementing a server computing device 700 that can be used to implement various aspects of the various technologies presented herein. The authentication device(s) 108 discussed above may include some or all of the components discussed below with reference to the server computing device 700.

[0094] First, server computer 700 can be a standard tower, rack, or blade server computer appropriately configured to provide the computing resources described herein. As mentioned above, computing resources provided by cloud computing networks or data centers can be data processing resources, such as VM instances or hardware computing systems, database clusters, computing clusters, storage clusters, data storage resources, database resources, and network resources. Some servers 700 can also be configured to execute resource managers capable of instantiating and / or managing computing resources. For example, in the case of VM instances, the resource manager can be a super-supervisor or another type of program configured to enable the execution of multiple VM instances on a single server computer 700. Server computers 700 in data centers can also be configured to provide network services and other types of services.

[0095] Server computer 700 includes a baseboard 702 or "motherboard," which is a printed circuit board to which multiple components or devices can be connected via a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units (CPUs) 704 operate together with a chipset 706. The CPU 704 may be a standard programmable processor that performs the arithmetic and logic operations required to perform the operation of computer 700.

[0096] The CPU 704 performs operations by manipulating switching elements that distinguish and change these states, transitioning from one discrete physical state to the next. Switching elements typically include electronic circuitry, such as flip-flops, that maintains one of two binary states, and electronic circuitry that provides an output state based on a logical combination of the states of one or more other switching elements, such as logic gates. These basic switching elements can be combined to create more complex logic circuits, including registers, adder-subtractor units, arithmetic logic units, and floating-point units.

[0097] Chipset 706 provides an interface between CPU 704 and the remaining components and devices on substrate 702. Chipset 706 can provide an interface to RAM 708, which serves as the main memory in computer 700. Chipset 706 can also provide an interface to a computer-readable storage medium, such as read-only memory (ROM) 710 or non-volatile RAM (NVRAM), for storing basic routines that help boot computer 700 and transfer information between various components and devices. ROM 710 or NVRAM can also store other software components required for the operation of computer 700 according to the configuration described herein.

[0098] Computer 700 can operate in a networked environment using logical connections to remote computing devices and computer systems via a network. Chipset 706 may include functionality for providing network connectivity via a network interface card (NIC) 712 (e.g., a Gigabit Ethernet adapter). NIC 712 enables computer 700 to connect to other computing devices via a network. It should be understood that multiple NICs 712 may be present in computer 700, thereby connecting the computer to other types of networks and remote computer systems.

[0099] Computer 700 can be connected to storage device 718, which provides non-volatile storage for the computer. Storage device 718 can store operating system 720, programs 722, and data (described in more detail herein). Storage device 718 can be connected to computer 700 via storage controller 714 connected to chipset 706. Storage device 718 can consist of one or more physical storage units. Storage controller 714 can interface with physical storage units via a Serial Amount SCSI (SAS) interface, a Serial Advanced Technology (SATA) interface, an FC interface, or other types of interfaces used for physical connections and data transfer between the computer and physical storage units.

[0100] Computer 700 can store data on storage device 718 by changing the physical state of physical storage units to reflect the stored information. In different embodiments of this specification, the specific changes in physical state can depend on various factors. Examples of these factors may include, but are not limited to, the technology used to implement the physical storage units, whether storage device 718 is characterized as a primary storage device or a secondary storage device, etc.

[0101] For example, computer 700 can store information in storage device 718 by issuing instructions via storage controller 714 to change the magnetic properties of a specific location within a disk drive unit, the reflection or refraction properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical medium are also possible without departing from the scope and spirit of this specification; the foregoing examples are provided for illustrative purposes only. Computer 700 can also read information from storage device 718 by detecting the physical state or characteristics of one or more specific locations within a physical storage unit.

[0102] In addition to the aforementioned high-capacity storage device 718, computer 700 can access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. Those skilled in the art will understand that a computer-readable storage medium is any available medium that provides non-transitory storage of data and can be accessed by computer 700. In some examples, operations performed by computer 700 and / or any components included therein may be supported by one or more devices similar to computer 700.

[0103] By way of example and not limitation, computer-readable storage media can include volatile and non-volatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory or other solid-state memory technologies, compact disc ROM (CD-ROM), digital versatile disc (DVD), high-definition DVD (HD-DVD), Blu-ray or other optical storage devices, magnetic cartridges, magnetic tape, disk storage devices or other magnetic storage devices, or any other medium that can be used to store desired information in a non-transitory manner.

[0104] As briefly described above, storage device 718 may store operating system 720 for controlling the operation of computer 700. According to one embodiment, the operating system includes a LINUX operating system. According to another embodiment, the operating system includes one from Microsoft Corporation of Redmond, Washington. SERVER operating system. In another embodiment, the operating system may include one of the UNIX operating systems or variants thereof. It should be understood that other operating systems may also be used. Storage device 718 may store other systems, applications, and data used by computer 700.

[0105] In one embodiment, storage device 718 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into computer 700, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. As described above, these computer-executable instructions transform computer 700 by specifying how CPU 704 transitions between various states. According to one embodiment, computer 700 has access to a computer-readable storage medium storing the computer-executable instructions, which, when executed by computer 700, perform the above-described... Figures 3 to 5 The various processes described herein. The computer 700 may also include a computer-readable storage medium having instructions stored thereon for performing any other computer-implemented operations described herein.

[0106] The computer 700 may also include one or more input / output controllers 716 for receiving and processing input from a plurality of input devices, such as a keyboard, mouse, touchpad, touchscreen, electronic pen, or other types of input devices. Similarly, the input / output controllers 716 may provide output to a display, such as a computer monitor, flat panel display, digital projector, printer, or other types of output device. It should be understood that the computer 700 may not include... Figure 7 All components shown may include Figure 7 Other components not explicitly shown in the document, or those that can be utilized with Figure 7 The architecture shown is completely different.

[0107] The server computer 700 may also store in storage device 718 authentication component 724 (which may operate similarly to authentication component 114 and / or authentication component 208), information 726 (which may include and / or represent information 118 and / or information 212), one or more features 728 (which may include and / or represent one or more features 116 and / or one or more features 210), one or more transitions 730 (which may include and / or represent one or more transitions 120 and / or one or more transitions 214), one or more credentials 732 (which may include and / or represent one or more credentials 206), one or more authentication requests 734 (which may include and / or represent authentication request 124 and / or authentication request 218), and authentication data 736 (which may include and / or represent authentication data 128 and / or authentication data 222).

[0108] In general, this disclosure describes techniques for device-to-device authentication. For example, a first device may detect a second device, such as when a user physically attaches the second device to the first device or when the second device wirelessly communicates with the first device. Then, components of the first device and / or an authentication entity may determine to authenticate the second device. In some instances, the component determines to authenticate the second device using information associated with the environment of the second device. To authenticate the second device, the authentication entity may send a request to the user, receive a response from the user, and then verify the response. After authentication, the first device may determine that the second device includes a trusted device and establish a connection with the second device.

[0109] While the invention has been described with reference to specific embodiments, it should be understood that the scope of the invention is not limited to these specific embodiments. Since other modifications and alterations made to suit specific operating requirements and environments will be readily apparent to those skilled in the art, the invention is not to be considered limited to the examples chosen for disclosure purposes, and covers all changes and modifications that do not constitute a departure from the true spirit and scope of the invention.

[0110] Although this application describes embodiments with specific structural features and / or methodological actions, it should be understood that the claims are not necessarily limited to the specific features or actions described. Rather, the specific features and actions are merely illustrative embodiments falling within the scope of the claims of this application.

Claims

1. A first electronic device, comprising: One or more processors; as well as One or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: A second electronic device was detected. Receive information representing the environment of the second electronic device from the second electronic device, wherein the information includes first information representing one or more first characteristics associated with a first state of the environment; Store second information, the second information representing one or more second characteristics associated with a second state of the environment; Based on comparing the one or more second characteristics with the one or more first characteristics, at least one transition of the second state of the environment relative to the first state of the environment is determined; Using components of the communication stack, it is determined whether to use an authentication service to authenticate the second electronic device, wherein the determination to authenticate the second electronic device is based at least in part on the information representing the environment of the second electronic device, and wherein the determination to authenticate the second electronic device is based at least in part on the transition; Send a request to authenticate the second electronic device to one or more devices associated with the authentication service; and Receive an indication from the one or more devices that the one or more devices have authenticated the second electronic device.

2. The first electronic device as claimed in claim 1, wherein, The component is included in one or more layers associated with the communication stack.

3. The first electronic device as claimed in claim 1, wherein, Sending a request to authenticate the second electronic device includes sending a request to the one or more devices to authenticate the second electronic device using multi-factor authentication.

4. The first electronic device as claimed in claim 1, wherein, The information represents at least one of the following: The media access control address associated with the second electronic device; The Internet Protocol address associated with the second electronic device; Connection information associated with the second electronic device; The location associated with the second electronic device; The time period associated with the previous connection to the second electronic device; or The action to be performed by the second electronic device.

5. The first electronic device as claimed in claim 1, wherein the operation further comprises: Based at least in part on the information, it is determined that the first electronic device has not been connected to the second electronic device. Furthermore, the determination to authenticate the second electronic device is based at least in part on the fact that the first electronic device has not yet been connected to the second electronic device.

6. The first electronic device as claimed in any one of claims 1 to 5, further comprising: Input interface, Furthermore, detecting the second electronic device includes detecting that the second electronic device has been inserted into the input interface.

7. The first electronic device as claimed in any one of claims 1 to 5, wherein the operation further comprises: Receive credentials from the second electronic device; The second electronic device is authenticated using at least the credentials and the instructions; as well as The connection to the second electronic device is established, at least in part, based on the authentication of the second electronic device.

8. A method for device authentication, comprising: The first electronic device detects that the second electronic device is attempting to establish a direct connection with the first electronic device; The first electronic device determines to use an authentication service to authenticate the second electronic device, wherein determining to authenticate the electronic device includes: Receive information representing the environment of the second electronic device from the second electronic device, wherein the information includes first information representing one or more first characteristics associated with a first state of the environment; The information is analyzed using components of the communication stack associated with the first electronic device; Store second information, the second information representing one or more second characteristics associated with a second state of the environment; Based on comparing the one or more second characteristics with the one or more first characteristics, at least one transition of the second state of the environment relative to the first state of the environment is determined; The component determines to authenticate the second electronic device based at least in part on the analysis of the information, wherein the determination to authenticate the second electronic device is based at least in part on the information representing the environment of the second electronic device, and wherein the determination to authenticate the second electronic device is based at least in part on the transition; Send a request to authenticate the second electronic device to one or more devices associated with the authentication service; and Receive an indication from the one or more devices that the one or more devices have authenticated the second electronic device.

9. The method of claim 8, wherein, Sending a request to authenticate the second electronic device includes sending a request to the one or more devices to authenticate the second electronic device using multi-factor authentication.

10. The method of claim 8, wherein, The information represents at least one of the following: The media access control address associated with the second electronic device; The Internet Protocol address associated with the second electronic device; Connection information associated with the second electronic device; The location associated with the second electronic device; The time period associated with the previous connection to the second electronic device; or The action to be performed by the second electronic device.

11. The method of claim 8, further comprising: The second electronic device is determined to include a new electronic device, at least in part, based on the information stated therein. Furthermore, the determination to authenticate the second electronic device is based at least in part on the fact that the second electronic device includes the new electronic device.

12. The method according to any one of claims 8 to 11, wherein, Detecting the second electronic device includes: the first electronic device detecting that the second electronic device has been inserted into the input interface of the first electronic device.

13. The method of any one of claims 8 to 11, further comprising: Receive credentials from the second electronic device; The second electronic device is authenticated using at least the credentials and the instructions; as well as A direct connection to the second electronic device is established, at least in part, based on the authentication of the second electronic device.

14. One or more devices for authentication services, including: One or more processors; as well as One or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: Store first information, which represents the first state of the environment of the electronic device; Receive second information, the second information representing a second state of the environment of the electronic device; The authentication of the electronic device is determined at least in part based on the first information and the second information; as well as Authenticate the electronic device. The operation further includes: The first information is analyzed relative to the second information to identify changes associated with the environment. Furthermore, the determination of authentication of the electronic device is based at least in part on the transition.

15. A first electronic device, comprising: A means for detecting that a second electronic device is attempting to establish a direct connection with the first electronic device; A means for determining whether to use an authentication service to authenticate the second electronic device; A means for sending a request to one or more devices associated with the authentication service to authenticate the second electronic device; as well as A means for receiving from the one or more devices an indication that the one or more devices have authenticated the second electronic device. The device used for determining includes: A means for receiving information representing the environment of the second electronic device from the second electronic device, wherein the information includes first information representing one or more first characteristics associated with a first state of the environment; A means for analyzing the information using components of a communication stack associated with the first electronic device; A means for storing second information, the second information representing one or more second characteristics associated with a second state of the environment; A means for determining at least one transition of a second state of an environment relative to a first state of the environment by comparing the one or more second characteristics with the one or more first characteristics; A means for determining, by the component at least in part, to authenticate the second electronic device based on the information analyzed, wherein the determination to authenticate the second electronic device is at least in part based on the information representing the environment of the second electronic device, and wherein the determination to authenticate the second electronic device is at least in part based on the transition.

16. The first electronic device as claimed in claim 15, wherein, The means for sending a request to authenticate the second electronic device includes: means for sending a request to the one or more devices to authenticate the second electronic device using multi-factor authentication.

17. The first electronic device as claimed in claim 15, wherein, The information represents at least one of the following: The media access control address associated with the second electronic device; The Internet Protocol address associated with the second electronic device; Connection information associated with the second electronic device; The location associated with the second electronic device; The time period associated with the previous connection to the second electronic device; or The action to be performed by the second electronic device.

18. The first electronic device of claim 15, further comprising: Means for determining, at least in part, based on said information, that the second electronic device includes a new electronic device. Furthermore, the determination to authenticate the second electronic device is based at least in part on the fact that the second electronic device includes the new electronic device.

19. The first electronic device as claimed in any one of claims 15 to 18, wherein, The means for detecting the second electronic device includes: means for the first electronic device to detect that the second electronic device has been inserted into the input interface of the first electronic device.

20. The first electronic device as claimed in any one of claims 15 to 18, further comprising: A means for receiving credentials from the second electronic device; A means for authenticating the second electronic device using at least the credentials and the instructions; as well as A means for establishing a direct connection with the second electronic device, at least in part based on authentication of the second electronic device.

21. A computer program product comprising instructions that, when executed by an electronic device, cause the electronic device to perform the steps of the method according to any one of claims 8 to 13.

22. A computer-readable medium comprising instructions that, when executed by an electronic device, cause the electronic device to perform the steps of the method according to any one of claims 8 to 13.

Images