Intelligent download and session copy

Abstract

In some examples, methods, systems, devices, and machine-readable media are disclosed that use one or more images displayed by a first application (e.g., a quick response (QR) code) to provide a location to obtain a second application and copy a session from the first application to the second application upon downloading. In some examples, the session includes an authenticated session such that when the session is copied, when the user has logged in to the first application, the user logs in to the network-based service within the second application with the same account as the user.

Description

Technical Field

[0001] Embodiments relate to software application security. Some embodiments relate to securely downloading applications and transferring sessions across applications. Background Art

[0002] As the computing power of hardware processors, memory devices, and other electronic devices increases and the associated costs of these devices decrease, the number of computing devices typically owned by an individual increases. For example, a user may have one or more desktop computers; laptop computers; mobile devices such as mobile phones or tablet computers; smart watches, smart glasses, or other devices. These devices may be driven by different types of processors with different instruction sets. In addition, these devices may each have a different operating system.

[0003] As a result, an application that is compatible with a first device may not be compatible with a second device. Additionally, each different device type may have different physical characteristics and form factors that require different graphical user interfaces (GUIs). Thus, a first version of an application written for a first computing device may not be easily usable on a second computing device.

[0004] Therefore, application developers have created different versions of applications for different hardware and operating system platforms. Although these different versions share some functions and features, they are customized for the platform they are designed for. The unified communication application can have a PC, OS devices, Device and version of Apple iOS device. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the drawings, which are not necessarily drawn to scale, like reference numerals may describe similar components in different views. Like numbers with different letter suffixes may represent different instances of similar components. The drawings generally illustrate various embodiments discussed in this document by way of example and not limitation.

[0006] Figure 1 An example diagram illustrating application downloading according to some examples of the present disclosure is illustrated.

[0007] Figure 2 An example diagram showing session copies is illustrated according to some examples of the present disclosure.

[0008] Figure 3 A logical block diagram of an authentication component, an application service, a first computing device, and a second computing device according to some examples of the present disclosure is illustrated.

[0009] Figure 4 A flow chart of a method of a first application according to some examples of the present disclosure is illustrated.

[0010] Figure 5 A flow chart of a method of downloading and transferring a session to a second application running on a second computing device according to some examples of the present disclosure is illustrated.

[0011] Figure 6 A flowchart of a method for a network-based service to transfer a session from a first application to a second application according to some examples of the present disclosure is illustrated.

[0012] Figure 7 is a block diagram illustrating an example of a machine upon which one or more embodiments may be implemented. DETAILED DESCRIPTION

[0013] The user may not know that the software developer has versions available for their other devices. Even if the user knows, the user may also have doubts about downloading these versions, because it may require additional steps to download and set up. For example, the user may not know the location of obtaining these other versions. Even if the device has a dedicated website for downloading and / or purchasing applications, other applications listed on these websites may also try and deceive users to download the wrong application by any means. In the best case, this represents a significant annoyance to the user, but in the worst case, this may cause malware, viruses or other unwanted behaviors. In addition, the user may have to authenticate the application, which requires them to remember their login credentials. These factors may cause significant resistance to adopting applications across the supported device ecosystem. Although there are these problems for different versions of the application, there are also these problems for the second device for the same version. For example, the user may have multiple personal computers, but due to the problems discussed previously, there may be doubts about obtaining the second application for the second computing device. In addition, due to some of the above-mentioned problems, the user may have doubts about deploying related applications on the same machine.

[0014] Disclosed in some examples are methods, systems, devices, and machine-readable media that use one or more images (e.g., a quick response (QR) code) displayed by a first application to provide a location to obtain a second application and copy a session from the first application to the second application once downloaded. In some examples, the session includes an authenticated session so that when the session is copied, the user is logged into a network-based service within the second application with the same account as the user when the user is already logged into the first application. Thus, providing a download link and a copy of the session provides a way for the user to easily use the first application to download and log into the second application without requiring a username and password or other credentials. Thus, the system reduces two inhibitors to adopting the second application.

[0015] In some examples, the first application provides a first image (such as a QR code) with a link to download the second application within the GUI of the first application. A user captures the first image using an image capture device and an application and decodes the link within the image to obtain the second application. In some examples, the first image includes a session id for a session between the first application and the network-based service.

[0016] After downloading the second application and running the second application, in some examples, the session id is passed to the second application at initial runtime, for example, by a download service or an operating system. This triggers the second application to enter a session copy initial setup process. The second application sends the session id to the network-based service. The network-based service then causes the first image displayed by the first application to be replaced by a second image. The second image is encoded using an authentication secret. The authentication secret is an authentication secret used by the first application or an authentication secret created by the network-based service for the second application.

[0017] If the second application has not passed the session id, in some examples, the second application provides the user with an option to copy the session in the initial setup flow. The option, when selected by the user, starts the image capture mode of the second application. The user then captures the first QR code again. The second application recognizes that the QR code encodes a download link and a session id for the second application. The download link can be ignored, and the session id is then sent to the network-based service, as previously described, which triggers the replacement of the first image with the second image.

[0018] The second application then captures the second image, which encodes an authentication secret used to authenticate to the network-based service (directly or through an authentication component). Using an image to encode the download link and / or the authentication secret eliminates the need for the user to manually click through multiple setup steps on the second application and enter their credentials. In some examples, the user does not have to manually take a picture of the first image or the second image, but the image capture application(s) can automatically capture an image when a QR code or other image encoded with one or more values ​​is detected. Therefore, the user is unaware of the replacement of the first image with the second image.

[0019] As used herein, an application is a set of operating instructions that implement a set of functions. Although the disclosure herein relates to a first application and a second application having the same core set of functions and working with the same network-based service, such as a mobile application and a desktop application, in other examples, the applications can be different applications having different functions and / or working with different network-based services (e.g., a network-based service that authenticates using a common authentication component between the first application and the second application).

[0020] Now go to Figure 1 , an example diagram 100 of application download according to some examples of the present disclosure is shown. A user of a first application on a first computing device 105, illustrated as a desktop computing device, authenticates with an authentication component 108 of a network-based service at operation 110. In some examples, the authentication component 108 is part of the network-based service, but in other examples, it is a separate service, such as a federated identity service. The authentication creates an authentication secret or record 134 with a corresponding session ID at operation 112.

[0021] In some examples, during use of the first application, a prompt is presented to the user on a display of the first application on the first computing device 105 that a second application is available, such as a second application for one or more other computing devices. The user selects or otherwise indicates an option in the first application corresponding to the prompt to indicate a desire to obtain the second application. In response, the first application on the first computing device 105 displays a first image (e.g., as shown, a QR code) encoding a location from which the second application can be downloaded. The image is created by the first application or by a network-based application service corresponding to the first application and provided to the first application at operation 113.

[0022] At operation 116, the user captures the first image using an image capture application and an image capture device of a second computing device 104. Once captured, the second computing device attempts to extract a location from the first image in which the second application is obtained. If successful, then in some examples, the application is automatically downloaded at operation 118. In other examples, one or more prompts confirm that the user wishes to download the application. After receiving confirmation from the user, the application is downloaded at operation 118. In some examples, the location includes a website or other uniform resource locator (URL). In some examples, the location is an application server, such as application service 106.

[0023] In some examples, the first image encodes a session id that is passed to the application service 106 or to the operating system of the second computing device 104. In some examples, the session id is passed to the second application when executed as a payload data object. In some examples, a generic capture application used to capture and decode the link from the first image also reads the session identifier and passes it to the second application when first executed. In some examples, the session id is passed to the second application by the application service, a network-based service, or the operating system of the second computing device 104. For example, in some examples, the session id is passed to the application service 106 as part of a download link URL. Example application services 106 include Microsoft Google Play wait.

[0024] Now go to Figure 2 , shows an example diagram 200 of a session copy according to some examples of the present disclosure. In some examples, second computing device 204 is the same computing device as second computing device 104. In some examples, first computing device 205 is the same computing device as first computing device 105. In some examples, authentication component 208 is the same authentication component as authentication component 108. Figure 2 In some examples this occurs after the second application is downloaded, such as in Figure 1 Occurs after it has ended.

[0025] Once the second application has been installed on the second device, upon first execution, the application enters a configuration mode to authenticate the user and set up the application. This is referred to as a "first run" user experience. Figure 1The first image displayed in also encodes a session identifier of a user's session between the first application and the network-based application service (or authentication component 108) corresponding to the first application. In some examples, the second application, when executed for the first time, recognizes that the operating system is passing in, for example, a session ID as a payload. In response, the second application infers that the user is attempting to copy a session from another device and will use an image capture process instead of a conventional first run experience including username and password entry to start the session copy flow. In these examples, the second application queries the authentication component 208 at operation 222 using the session ID. In response, the authentication component 208 can cause a second image to be displayed on a display device coupled to the first computing device 205 by sending a second image for display by the first device to the first device 202 at operation 226. In some examples, the first image is replaced with the second image. In addition, at operation 228, the second application enters an image capture mode and captures the second image. The second image has an encoded session authentication secret. The second application attempts to extract the session authentication secret in the second image. If the second application is successful, the second application sends the session authentication secret to the authentication component 108 for authentication at operation 230. If the authentication secret is accepted by the authentication component 108, the user is then logged in and can begin using the second application as an authenticated user at operation 232.

[0026] In other examples, the operating system of the second device does not pass the session id within the first image to the second application. In these examples, the second application, when first executed, provides an option within the first run flow for the user to authenticate using an image. Upon receiving input from the user that they wish to authenticate using an image, the second application enters an image capture mode. The second application captures the first image displayed by the first application. The second application decodes both the download link and the session id. The second application recognizes the download link itself and ignores the download link. Then, at operation 222, the second application sends the session id to the authentication component.

[0027] In response, in some examples, authentication component 208 causes a second image to be displayed on a display device coupled to first computing device 205 by sending a second image for display by the first computing device to first device 202 at operation 226. In some examples, the first image is replaced with the second image. Additionally, at operation 228, the second application enters an image capture mode and captures the second image. The second image has an encoded session authentication secret. The second application attempts to extract the session authentication secret in the second image. If the second application succeeds, the second application sends the session authentication secret to authentication component 108 at operation 230 for authentication. If authentication component 108 accepts the authentication secret, the user is then logged in and can begin using the second application as an authenticated user.

[0028] As noted, the authentication secret is used by an application to call an application programming interface (API) to utilize one or more functions of a network-based service. The authentication secret is assigned by the network-based service after a first authentication using the user's secret credentials. The authentication secret allows the user to be securely authenticated in subsequent API calls after the initial authentication without potentially exposing the user's credentials. Thus, the authentication secret can be periodically changed without changing the user's credentials. Example authentication secrets include OAuth tokens, etc.

[0029] In other examples, the second application utilizes other signals indicating that the user is attempting to copy a session from another device and automatically starts or facilitates a session copy flow instead of a regular first run experience. For example, if the user has an active session on another device within the same local network. Upon first execution of the second application, the second application sends a discovery message over the local network. In these examples, the first application subscribes to receive this type of discovery message and responds with a session id and / or session authentication secret. In other examples, the user selects an option within the first application of the second application to send a discovery message over the local network. Other applications respond, and the session copy may occur on the local network.

[0030] In yet other examples, an audible audio signal is sent by the first application and / or the second application through an audio reproduction device (e.g., a speaker) of the first device and / or the second device, and the audible audio signal can be picked up by another device. The audio signal encodes the download link, the session id, and / or the session authentication secret instead of an image. In yet another example, the system uses Bluetooth low energy or other short-range wireless technology.

[0031] In some examples, just before authentication, the user is prompted with one or more confirmation GUIs. For example, on the second application, a confirmation is displayed indicating that the second application is logging in as a specific user. In some examples, the GUI has an option to cancel the login, or ask for confirmation before continuing with the login. In some examples, if the GUI does not want to log in with the account, the GUI has an option to restart the initial first run experience. In some examples, on the first application, once the session is copied, the UI shows a "success" message.

[0032] The use of images to both provide download links and transfer sessions provides a secure way to download and authenticate applications. The use of visual methods ensures that the transmission of session information is limited to the visual range of the first computing device and not transmitted via other forms of communication that may be intercepted. In addition, the solution removes the opportunity for malicious applications to be legitimate applications within websites, search results, and application download centers. Therefore, the disclosed technology solves the technical problems of secure application provisioning and session authentication using technical solutions such as secure digital communication encoding through the use of images.

[0033] Figure 3 A logical block diagram of an authentication component 332 , an application service 342 , a first computing device 310 , and a second computing device 320 according to some examples of the present disclosure is illustrated. Figure 3 The components shown are exemplary, and one of ordinary skill in the art having the benefit of this disclosure will appreciate that additional components may be used. In addition, functionality from the various components may be combined. Figure 3 The components in may be implemented by one or more devices, such as in Figure 7 . For example, as software instructions to configure a hardware processor. In some examples, first computing device 310 may be the same computing device as first computing device 105, 205; second computing device 320 may be the same computing device as second computing device 104, 204; authentication component 332 may be the same authentication component as authentication component 108, 208; and application service 342 may be the same application service as application service 106.

[0034] The first computing device 310 executes a first application 312. In some examples, the first application 312 has a GUI component 314. The GUI component 314 displays content associated with the application; provides user options, settings, and controls; and displays one or more images. In some examples, the GUI provides a notification to the user that there is a second application available for the user. For example, the system periodically announces other applications. In other examples, a network-based service or authentication component identifies other devices used by the user and provides recommended applications based on the identified devices. For example, the system uses a general application such as a browser on the second computing device 320 to identify that the user is logged into the network-based service. The system determines that a second application is available for the second device and announces the availability to the user in the first application. In other examples, the system identifies that the user uses other applications from the same developer on the second computing device 320.

[0035] In some examples, GUI component 314 also provides one or more authentication login screens associated with authentication communication component 316. Authentication communication component 316 communicates with session authentication component 334 of authentication component 332 to authenticate the user of first computing device 310 using a network-based service. Authentication component 332 is part of the network-based service, or a separate service, such as a federated identity service. In some examples, the authentication utilizes a username and password. If the password matches a stored password for the username, the user is authenticated.

[0036] If the user expresses an interest in obtaining the second application, an image creation component 318 as part of the first application 312 or an image creation component 340 as part of the authentication component 332 creates an image that encodes the download location of the second application. In some examples, the image also includes a session id of the authenticated session of the user of the first application. In some examples, the session id is assigned by a session authentication component 334 of the authentication component 332. The GUI component can display the first image. The image is displayed by the GUI component 314 in the GUI of the first application.

[0037] In some examples, second computing device 320 includes an image capture component 322. In some examples, image capture component 322 is an image capture component 322 that is part of an operating system of second computing device 320. Image capture component 322 operates one or more image capture devices of second computing device 320. Example image capture devices include a camera, a video camera, an infrared camera, and the like.

[0038] The image capture component 322 captures a first image displayed in the GUI of the first application 312. The image capture component 322 extracts a download link for the second application 324 from the first image. The application download component 323 receives a location from the image capture component 322 and downloads the application from the location. The second application is downloaded automatically after one or more prompts or after receiving a confirmation from the user.

[0039] Upon executing the second application 324, the control component 331 determines that the second application 324 has not been configured and begins providing a first run experience of one or more GUI input screens by allowing the user to configure the GUI component 330 of the second application 324. In some examples, the second application receives the session id as part of the first image from the image capture component 322, the application download component 323, or a different component, such as an operating system of the second computing device 320. In these examples, the control component 331 skips the session copy configuration flow.

[0040] In some examples where the session id is not passed to the second application 324, the first run experience has a selectable GUI option of copying the session via an image. Upon selecting the selectable option of copying the session via an image, the image capture component 326 of the second application 324 is then started, and the user can capture the first image again. The control component 331 extracts a download link and a session identifier for the second application 324 from the first image. The control component 331 compares the download link to one or more known download locations of the second application 324 provided with the second application or obtained from a network-based source (such as a network-based service or authentication component 332). If the download link matches one of the known download locations of the second application 324, the control component 331 determines that the download link will be used to download the second application 324. Instead of downloading the second application 324 (which has already been downloaded), the control component 331 switches to a session copy configuration flow.

[0041] Once control component 331 has determined that the session copy configuration flow has begun, control component 331 sends the session identifier to client communication component 338 of authentication component 332 via authentication communication component 328. Client communication component 338 passes the session identifier to session copy component 336 of authentication component 332. In some examples, session copy component 336 causes the second image to be displayed by first computing device 310 via client communication component 338. In some examples, image creation component 340 creates the second image and sends it to first computing device 310. In other examples, image creation component 318 of first computing device 310 creates the second image. Encoded within the second image is an authentication secret.

[0042] The image capture component 326 of the second application captures the second image. The control component 331 extracts the authentication secret from the second image. The second application 324 then attempts to authenticate with the network-based service as a user through the authentication communication component 328 using the authentication secret through the authentication communication component 328. If the authentication secret is correct and the attempt is successful, the second application is logged into the network-based service as the same user as the first application 312.

[0043] GUI component 330 and control component 331 can then provide the functionality of the second application. For example, if the second application is a unified communication application, GUI component 330 can show communications to and from users (e.g., users logged into second application 324 and the same users logged into first application 312). In addition, GUI component 330 and control component 331 can provide users with the opportunity to create and send and receive new communications. Communications can include text, chat, file sharing, online meetings, etc.

[0044] As previously noted, authentication component 332 may include session authentication component 334. Session authentication component 334 authenticates a user to a network-based service. For example, by comparing the credentials to the user's stored credentials. Once the user is authenticated, a session is created using a session id, and an authentication secret is assigned by session authentication component 334. The authentication secret is used to replace the credentials for subsequent requests to the network-based service. The authentication secret may be changed periodically. This protects the credentials from snooping. Session authentication component 334 may ensure that subsequent API calls utilizing the authentication secret include the correct authentication secret for the session.

[0045] The client communication component 338 can communicate with one or more client devices, such as the first computing device 310 and the second computing device 320. The client communication component 338 can implement one or more communication protocols to communicate with the client devices. Similarly, in some examples, the authentication communication components 316 and 328 also implement the same protocol.

[0046] In some examples, image creation component 340 creates one or more images for display on first computing device 310. Example images include quick response (QR) codes, barcodes, images with hidden information via steganographic algorithms, etc. In some examples, an image is created at authentication component 332 and sent to first computing device 310. The image encodes a download link, session id, authentication secret, etc. In other examples, an audio file encoding these values ​​is created instead of an image. In these examples, instead of capturing an image, audio is played on a first computing device, and the audio is captured and decoded on a second computing device to send a download link, session id, and / or authentication secret. In some examples, a combination of image and audio is utilized. As noted, in some examples, image creation component 318 replaces image creation component 340, for example, to create an image in the direction of authentication component 332.

[0047] The session copy component 336 controls the copying of a session from the first computing device 310 to the second computing device 320. For example, the session copy component 336 receives a session ID from the second computing device 320. The session copy component 336 then matches the session ID with another authenticated session. For example, the session copy component 336 can match the session ID with a session active on the first computing device 310. Upon matching the session ID with a session active on the first computing device 310, the session copy component 336 instructs the image creation component 318 of the first computing device 310 to create a new image with an authentication secret and display it. In other examples, upon matching the session ID with a session active on the first computing device 310, the session copy component 336 instructs the image creation component 340 of the authentication component 332 to create a new image with an authentication secret. The new image is then sent to the first computing device, which displays it, using the client communication component 338.

[0048] In some examples, when the user of the first computing device 310 selects the download option for the second application 324 or selects the session copy option (e.g., the GUI may only offer to download the application, or offer to download the application and transfer the session), the authentication communication component 316 sends a notification to the authentication component 332 that the session will be copied. This serves as a security feature to prevent a rogue second application from transferring the session without approval from the first device. For example, without this feature, a rogue application could figure out the session id of the first application 312 and copy the session without approval from the user of the first application.

[0049] Once the authentication secret is decoded by the second application 324, the second application 324 uses it to authenticate with the authentication component's session authentication component 334. In some examples, the session copy component 336 can alert the session authentication component 334 to the second application's use of the authentication secret. In other examples, and as previously noted, the authentication secret in the second image is created specifically for the second application 324.

[0050] Application service 342 may include an authentication component 344 that can control access to applications in application storage component 346 and / or application download component 348 to registered users. Application storage component 346 stores and indexes applications uploaded by developers and product information web pages. In some examples, application download component 348 provides one or more product information web pages for users to browse and select applications. Once the user selects (and optionally pays for) an application, the application is downloaded by the user.

[0051] In some examples, authentication component 332, first computing device 310, second computing device 320, and application service 342 communicate via a packet-based network such as the Internet. Additionally, session copy or copying as used herein includes utilizing an authenticated session of a first application on a first device to authenticate the same user on a second application on a second device. In addition to a new authentication state for the second application, the user can continue to maintain an authentication state on the first application on the first device.

[0052] In some examples, the second application 324 may also include an image creation component 318 that implements the functionality described herein. In some examples, the second application 324 includes an image creation component 318 that may implement the same functionality as described herein. That is, the second application 324 may be able to copy the session to a third application using the same process of using images as described herein. In some examples, a first application on a first device utilizes this method to download and authenticate a second application on the same first device. For example, using a detachable camera or other input device.

[0053] Figure 4A flow chart of a method 400 of a first application according to some examples of the present disclosure is illustrated. At operation 410, the first application authenticates a user to a network-based service, such as through an authentication component. For example, a user enters a username and password in a GUI provided by the first application. The username and password are encrypted or otherwise protected in some examples and sent to the authentication component. If the username and password match the username and password of a valid account on the network-based service, the network-based service and / or authentication component creates a session identifier and assigns a cryptographic secret in some examples. The cryptographic secret is used to authenticate subsequent requests by the first application to the network-based service.

[0054] Once the user logs into the first application, at operation 412, the first application displays an indication that the second application is available for the second device. In some examples, this is done on the first run of the first application, periodically, randomly, etc. In other examples, the second application or the network-based service identifies that the user is logged into one or more services, such as a network-based service or another service with a second device, and the indication can be displayed in response to this determination. In other examples, the user navigates to a specific menu, such as a help menu that provides options for downloading a link. At operation 414, whether from the indication or whether the user navigates to the option in the menu, the first application receives a selection of the download option from the user within the GUI.

[0055] At operation 416, the first application creates or receives a first image. For example, the first application creates a QR code that encodes a download link for the second application and / or a session identifier of the active session created at operation 410. In some examples, the session identifier is provided by a network-based service or authentication component. In other examples, the first application sends an indication to the network-based service and / or authentication component that the user selected the option to download the second application and transfer the session. In these examples, the authentication component creates a QR code that encodes the download link and / or session identifier and sends it to the first application.

[0056] At operation 418, the first application causes the first image to be displayed. For example, on a display of a first computing device that is communicatively coupled to the first application on which the first application is executing. In some examples, the first application uses one or more operating system calls to display the first image in a first GUI. At operation 420, the first application receives or is requested to create (and creates) a second image from the authentication component, and in some examples, the second image encodes the authentication secret. At operation 422, the first application causes the second image to be displayed. For example, the first application replaces the first image with the second image in the GUI. In other examples, the first application displays both the first GUI and the second GUI simultaneously.

[0057] At operation 424, the first application receives confirmation from the authentication component that the second application successfully transferred the session. At operation 426, in some examples, the first application displays a confirmation message indicating that the session was successfully transferred. In some examples, the first image and / or the second image are stopped from being displayed.

[0058] Figure 5 A flow chart of a method 500 of downloading and transferring a session to a second application executing on a second computing device according to some examples of the present disclosure is illustrated. At operation 510, the second computing device captures a first image displayed by a first computing device (e.g., in a GUI of a first application). In some examples, the image is captured using an image capture application of the second computing device. For example, an image capture application that is part of an operating system of the second device. At operation 512, the image capture application decodes a download link from the first image. In some examples, the image capture application also decodes a session identifier. At operation 514, the second device uses the decoded link to download the second application.

[0059] At operation 516, the second computing device executes the second application. For example, the second computing device automatically executes the second application after installing the second application, or the user selects the second application. At operation 518, the second application begins a session copy flow by starting an image capture mode of the second application. For example, the second application recognizes that it has not been configured and asks the user if they want to transfer the session using an image. If the user accepts, the image capture mode of the second application is started. Similarly, if the session id is passed as a payload to the second application by an operating system, an image capture component, or a download location - the second application begins a session copy flow by entering the image capture mode of the second application.

[0060] If the session id is not passed to the second application, flow proceeds to operations 520 and 522. At operation 520, the first image is captured using an image capture mode of the second application. The second application then determines at operation 522 that the first image encodes a link and a session identifier for downloading the second application. Flow then proceeds to operation 524.

[0061] If the session id is passed to the second application, or when the session id is determined as a result of performing operations 520 and 522, the second application sends the session id to an authentication component or a network-based service provider server, for example, over a packet-based network. This causes the network-based service provider to cause the new image to replace the first image. At operation 526, an image capture component of the second application captures the second image. At operation 528, the second image may be decoded to obtain a secret value, such as an authentication secret. At operation 530, using the secret value, the second application authenticates to the network-based service (e.g., via an authentication component).

[0062] Figure 6 A flow chart of a method 600 of transferring a session from a first application to a second application by a network-based service according to some examples of the present disclosure is illustrated. At operation 610, a user of the first application is authenticated. For example, the first application sends a username and password or other credentials, and the network-based service checks to ensure that the username is for a valid account and the password is correct for the account. After authenticating the user, at operation 612, in some examples, a session is created and a session id is assigned. In addition, a secret key is created. In some examples, a session id and / or secret key (e.g., an authentication secret) is provided to the first application at operation 614. The first application uses the session id and / or secret key to call one or more application programming interface calls to access the services of the network-based service.

[0063] At operation 616, in some examples, the first application requests an image with a download link to the second application and a session identifier for transferring the session. In some examples, the request includes a specific version of the second application (e.g., an Android version or an iOS version). In other examples, the first application generates the image itself (e.g., using a configured download link within the first application). At operation 618, an image is created that encodes the download link and / or the session identifier. At operation 620, the image is transmitted to the first application (e.g., via a packet-based network). As noted, in some examples, the first application creates the image, and therefore, in some implementations, operations 616, 618, and 620 may not be performed.

[0064] At operation 622, the second application provides a session identifier. This signals to the network-based service that the second device downloaded the second application and is now executing the second application. In response, the network-based service creates a second image encoding the secret value at operation 624. At operation 626, the second image is sent to the first application for display. In other examples, the network-based service sends instructions to the first application to create a second image encoding the secret value instead of performing operations 622 and 624.

[0065] At operation 628, the network-based service receives a secret key from the second application. For example, during an authentication attempt or a subsequent API call, one or more services of the network-based service are accessed. Based on the receipt of the secret key, the second application is authenticated at operation 630. At operation 632, in some examples, a successful session copy indication is provided to the first application for display.

[0066] Various network-based services are disclosed herein. In some examples, these services are provided by one or more server computing devices, edge computing devices, etc.

[0067] Figure 7 A block diagram of an example machine 700 is shown on which any one or more of the techniques (e.g., methods) discussed herein may be performed. For example, a first computing device 105, 205, 310; a second computing device 104, 204, 320; an authentication component 108, 208, 332; an application service 106342. The machine 700 may be configured by hardware and / or software to perform Figures 4 to 6Method. In alternative embodiments, the machine 700 may be operated as a standalone device, or may be connected (e.g., networked) to other machines. In a networked deployment, the machine 700 may operate in the capacity of a server machine, a client machine, or both in a server-client network environment. In an example, the machine 700 may act as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. The machine 700 may be a personal computer (PC), a server computing device, a server computing device as part of a service, a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a smart phone, a web device, a network router, a switch or a bridge, or any machine capable of executing instructions (sequentially or otherwise) specifying actions to be taken by the machine. In addition, although only a single machine is illustrated, the term "machine" should also be considered to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to execute any one or more of the methods discussed herein, such as cloud computing, software as a service (SaaS), and other computer cluster configurations.

[0068] As described herein, examples may include or may operate on one or more logical units, components, or mechanisms (hereinafter referred to as "components"). A component is a tangible entity (e.g., hardware) that can perform a specified operation and can be configured or arranged in a particular manner. In an example, a circuit can be arranged as a component in a specified manner (e.g., internally or relative to an external entity, such as other circuits). In an example, all or part of one or more computer systems (e.g., independent, client, or server computer systems) or one or more hardware processors can be configured by firmware or software (e.g., instructions, application parts, or applications) to operate as a component for performing a specified operation. In an example, the software may reside on a machine-readable medium. In an example, the software, when executed by the underlying hardware of the component, causes the hardware to perform the specified operation of the component.

[0069] Thus, the term "component" is understood to encompass a tangible entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., temporarily) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operations described herein. Consider an example where a component is temporarily configured, each of the components need not be instantiated at any one time. For example, where a component comprises a general-purpose hardware processor configured using software, the general-purpose hardware processor may be configured as corresponding different components at different times. The software may configure the hardware processor accordingly, for example, to constitute a particular module at one time and to constitute different components at different times.

[0070] The machine (e.g., computer system) 700 may include one or more hardware processors, such as processor 702. Processor 702 may be a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof. The machine 700 may include a main memory 704 and a static memory 706, some or all of which may communicate with each other via an interconnect (e.g., a bus) 708. An example of the main memory 704 may include a synchronous dynamic random access memory (SDRAM), such as a double data rate memory, such as DDR4 or DDR5. The interconnect 708 may be one or more different types of interconnects, such that one or more components may be connected using a first type of interconnect, and one or more components may be connected using a second type of interconnect. Example interconnects may include a memory bus, a peripheral component interconnect (PCI), a peripheral component interconnect express (PCIe) bus, a universal serial bus (USB), and the like.

[0071] The machine 700 may also include a display unit 710, an alphanumeric input device 712 (e.g., a keyboard), and a user interface (UI) navigation device 714 (e.g., a mouse). In an example, the display unit 710, the input device 712, and the UI navigation device 714 may be a touch screen display. The machine 700 may additionally include a storage device (e.g., a drive unit) 716, a signal generating device 718 (e.g., a speaker), a network interface device 720, and one or more sensors 721, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors. The machine 700 may include an output controller 728, such as a serial (e.g., universal serial bus (USB), parallel or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to transmit or control one or more peripheral devices (e.g., printer, card reader, etc.).

[0072] The storage device 716 may include a machine-readable medium 722 on which is stored one or more sets of data structures or instructions 724 (e.g., software) embodying or used by any one or more of the techniques or functions described herein. The instructions 724 may also reside, completely or at least partially, within the main memory 704, within the static memory 706, or within the hardware processor 702 during execution by the machine 700. In an example, one or any combination of the hardware processor 702, the main memory 704, the static memory 706, or the storage device 716 may constitute a machine-readable medium.

[0073] Although the machine-readable medium 722 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (eg, a centralized or distributed database and / or associated caches and servers) configured to store one or more instructions 724 .

[0074] The term "machine-readable medium" may include any medium capable of storing, encoding or carrying instructions for execution by the machine 700 and causing the machine 700 to perform any one or more of the techniques of the present disclosure, or any medium capable of storing, encoding or carrying data structures used by such instructions or associated with such instructions. Non-limiting machine-readable medium examples may include solid-state memory and optical and magnetic media. Specific examples of machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; random access memory (RAM); solid-state drives (SSD); and CD-ROM and DVD-ROM disks. In some examples, the machine-readable medium may include non-temporary machine-readable media. In some examples, the machine-readable medium may include machine-readable media that is not a temporary propagation signal.

[0075] Instructions 724 may also be sent or received over a communication network 726 via the network interface device 720 using a transmission medium. The machine 700 may communicate with one or more other devices wired or wirelessly using any of a variety of transmission protocols (e.g., frame relay, Internet Protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile phone network (e.g., a cellular network), a plain old telephone (POTS) network, and a wireless data network, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards, the IEEE 802.15.4 family of standards, the 5G New Radio (NR) family of standards, the Long Term Evolution (LTE) family of standards, the Universal Mobile Telecommunications System (UMTS) family of standards, a peer-to-peer (P2P) network, etc. In an example, the network interface device 720 may include one or more physical jacks (e.g., Ethernet, coaxial, or telephone jacks) or one or more antennas to connect to the communication network 726. In an example, the network interface device 720 may include multiple antennas to use at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technology for wireless communication. In some examples, the network interface device 720 may use multi-user MIMO technology for wireless communication.

[0076] Additional Notes and Examples

[0077] Example 1 is a method for downloading a first application on a first computing device and authenticating a user on the first application using an already authenticated session of a second application executed on a second computing device, the method comprising: using a hardware processor of the first computing device: capturing a first image encoding a link for downloading the first application in an image capture application of the first computing device, the first image being displayed by the second application on the second computing device; in response to capturing the first image, decoding the link; downloading the first application from the link; in response to downloading the first application, executing the first application, the first application: identifying a session identifier of a session between the second application and a network-based service from communications with the second computing device; providing the session identifier to the network-based service of the first application over a network, the network-based service replacing the first image with a second image on the second computing device; capturing the second image displayed by the second application, the second image being encoded with a secret value; decoding the second image to decode the secret value; and using the secret value to establish an authenticated session between the user of the first application and the network-based service.

[0078] In Example 2, the subject matter of Example 1 includes, wherein identifying the session identifier of the session between the second application and the network-based service from the communication with the second computing device includes: starting an image capture mode of the first application; capturing the first image displayed by the second application of the second computing device in the image capture mode of the first application; and determining that the first image encodes both a link for downloading the first application and a session identifier of an authenticated session between the second application and the network-based service.

[0079] In Example 3, the subject matter of Example 2 includes, wherein, in response to determining that the first image encodes both the link for downloading the first application and the session identifier: identifying the link for downloading the first application; and in response to identifying the link for downloading the first application, avoiding downloading the first application.

[0080] In Example 4, the subject matter of Examples 2-3 includes, wherein initiating the image capture mode of the first application is responsive to receiving a selection on a user interface of the first application to establish an authentication session using an encoded image.

[0081] In Example 5, the subject matter of Examples 1-4 includes, wherein the first image and the second image are Quick Response (QR) codes.

[0082] In Example 6, the subject matter of Examples 1-5 includes, wherein the second computing device is executing a different operating system than the first computing device.

[0083] In Example 7, the subject matter of Examples 1-6 includes, wherein the second application and the first application are different instances of the same application.

[0084] In Example 8, the subject matter of Examples 1-7 includes, wherein the network-based service includes a federated authentication component.

[0085] Example 9 is a system for downloading a first application on a first computing device and authenticating a user on the first application using an already authenticated session of a second application executing on a second computing device, the system comprising: the first computing device comprising: a hardware processor; a memory device storing instructions that, when executed by the hardware processor, cause the first computing device to perform operations comprising: capturing a first image encoding a link for downloading the first application in an image capture application of the first computing device, the first image being displayed by the second application on the second computing device; in response to capturing the first image, decoding the link; downloading the first application from the link; in response to downloading the first application, executing the first application, the first application: identifying a session identifier of a session between the second application and a network-based service from communications with the second computing device; providing the session identifier to the network-based service of the first application over a network, the network-based service replacing the first image with a second image on the second computing device; capturing the second image displayed by the second application, the second image being encoded with a secret value; decoding the second image to decode the secret value; and using the secret value to establish an authenticated session of the user of the first application with the network-based service.

[0086] In Example 10, the subject matter of Example 9 includes, wherein the operation of identifying the session identifier of the session between the second application and the network-based service from the communication with the second computing device includes: starting an image capture mode of the first application; capturing the first image displayed by the second application of the second computing device in the image capture mode of the first application; and determining that the first image encodes both a link for downloading the first application and the session identifier of the authenticated session between the second application and the network-based service.

[0087] In Example 11, the subject matter of Example 10 includes, wherein the operation further includes: in response to determining that the first image encodes both the link for downloading the first application and the session identifier: identifying the link for downloading the first application; and in response to identifying the link for downloading the first application, avoiding downloading the first application.

[0088] In Example 12, the subject matter of Examples 10-11 includes, wherein the operation of initiating the image capture mode of the first application is in response to receiving a selection on a user interface of the first application to establish an authentication session using an encoded image.

[0089] In Example 13, the subject matter of Examples 9-12 includes, wherein the first image and the second image are Quick Response (QR) codes.

[0090] In Example 14, the subject matter of Examples 9-13 includes, wherein the second computing device is executing a different operating system than the first computing device.

[0091] In Example 15, the subject matter of Examples 9-14 includes, wherein the second application and the first application are different instances of the same application.

[0092] In Example 16, the subject matter of Examples 9-15 includes, wherein the network-based service includes a federated authentication component.

[0093] Example 17 is a first computing device for downloading a first application on a first computing device and authenticating a user on the first application using an authenticated session of a second application executed on a second computing device, the first computing device comprising: a unit for capturing a first image encoding a link for downloading the first application in an image capture application of the first computing device, the first image being displayed by the second application on the second computing device; a unit for decoding the link in response to capturing the first image; a unit for downloading the first application from the link; a unit for executing the first application in response to downloading the first application, the first application comprising: a unit for identifying a session identifier of a session between the second application and a network-based service from communications with the second computing device; a unit for providing the session identifier to the network-based service of the first application over a network, the network-based service replacing the first image with a second image on the second computing device; a unit for capturing the second image displayed by the second application, the second image being encoded with a secret value; a unit for decoding the second image to decode the secret value; and a unit for using the secret value to establish an authenticated session between the user of the first application and the network-based service.

[0094] In Example 18, the subject matter of Example 17 includes, wherein the unit for identifying the session identifier of the session between the second application and the network-based service from communications with the second computing device includes: a unit for starting an image capture mode of the first application; a unit for capturing the first image displayed by the second application of the second computing device in the image capture mode of the first application; and a unit for determining that the first image encodes both the link for downloading the first application and the session identifier of the authenticated session between the second application and the network-based service.

[0095] In Example 19, the subject matter of Example 18 includes, in response to determining that the first image encodes both the link for downloading the first application and the session identifier: a unit for identifying the link for downloading the first application; and a unit for avoiding downloading the first application in response to identifying the link for downloading the first application.

[0096] In Example 20, the subject matter of Examples 18-19 includes, wherein the means for initiating the image capture mode of the first application is responsive to receiving a selection on a user interface of the first application to establish an authentication session using an encoded image.

[0097] In Example 21, the subject matter of Examples 17-20 includes, wherein the first image and the second image are Quick Response (QR) codes.

[0098] In Example 22, the subject matter of Examples 17-21 includes, wherein the second computing device is executing a different operating system than the first computing device.

[0099] In Example 23, the subject matter of Examples 17-22 includes, wherein the second application and the first application are different instances of the same application.

[0100] In Example 24, the subject matter of Examples 17-23 includes, wherein the network-based service includes a federated authentication component.

[0101] Example 25 is a machine-readable medium storing instructions for downloading a first application on a first computing device and authenticating a user on the first application using an already authenticated session of a second application executed on a second computing device, the instructions, when executed by the first computing device, causing the first computing device to perform operations including: capturing a first image encoding a link for downloading the first application in an image capture application of the first computing device, the first image being displayed by the second application on the second computing device; in response to the captured first image, decoding the link; downloading the first application from the link; in response to downloading the first application, executing the first application, the first application: identifying a session identifier of a session between the second application and a network-based service from communications with the second computing device; providing the session identifier to the network-based service of the first application over a network, the network-based service replacing the first image with a second image on the second computing device; capturing the second image displayed by the second application, the second image being encoded using a secret value; decoding the second image to decode the secret value; and using the secret value to establish an authenticated session between the user of the first application and the network-based service.

[0102] In Example 26, the subject matter of Example 25 includes, wherein the operation of identifying the session identifier of the session between the second application and the network-based service from the communication with the second computing device includes: starting an image capture mode of the first application; capturing the first image displayed by the second application of the second computing device in the image capture mode of the first application; and determining that the first image encodes both the link for downloading the first application and the session identifier of the authenticated session between the second application and the network-based service.

[0103] In Example 27, the subject matter described in Example 26 includes, wherein the operation further includes: in response to determining that the first image encodes both the link for downloading the first application and the session identifier: identifying the link for downloading the first application; and in response to identifying the link for downloading the first application, avoiding downloading the first application.

[0104] In Example 28, the subject matter of Examples 26-27 includes, wherein the operation of initiating the image capture mode of the first application is responsive to receiving a selection on a user interface of the first application to establish an authentication session using an encoded image.

[0105] In Example 29, the subject matter of Examples 25-28 includes, wherein the first image and the second image are Quick Response (QR) codes.

[0106] In Example 30, the subject matter of Examples 25-29 includes, wherein the second computing device is executing a different operating system than the first computing device.

[0107] In Example 31, the subject matter of Examples 25-30 includes, wherein the second application and the first application are different instances of the same application.

[0108] In Example 32, the subject matter of Examples 25-31 includes, wherein the network-based service includes a federated authentication component.

[0109] Example 33 is at least one machine-readable medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform the operations of an implementation of any of Examples 1-32.

[0110] Example 34 is an apparatus comprising means for implementing any of Examples 1-32.

[0111] Example 35 is a system implementing any of Examples 1-32.

[0112] Example 36 is a method of implementing any of Examples 1-32.

Claims

1. A method of downloading a first application on a first computing device and authenticating a user on the first application using an already authenticated session of a second application executing on a second computing device, the method comprising: Using the hardware processor of the first computing device: capturing, in an image capture application of the first computing device, a first image encoding a link for downloading the first application, the first image being displayed by the second application on the second computing device; responsive to capturing the first image, decoding the link; Downloading the first application from the link; In response to downloading the first application, executing the first application, the first application: identifying a session identifier of a session between the second application and the network-based service from communications with the second computing device; providing the session identifier to the network-based service of the first application over a network, the network-based service replacing the first image with a second image on the second computing device; capturing the second image displayed by the second application, the second image being encoded with a secret value; decoding the second image to decode the secret value; as well as An authenticated session of the user of the first application with the network-based service is established using the secret value.

2. The method according to claim 1, wherein: The session identifier identifying the session between the second application and the network-based service from the communication with the second computing device comprises: Starting an image capture mode of the first application; capturing, in the image capture mode of the first application, the first image displayed by the second application of the second computing device; and Determining that the first image encodes both the link for downloading the first application and the session identifier of the authenticated session between the second application and the network-based service.

3. The method according to claim 2, wherein: responsive to determining that the first image encodes both the link for downloading the first application and the session identifier: identifying the link for downloading the first application; as well as Responsive to identifying the link for downloading the first application, downloading the first application is avoided.

4. The method according to claim 2, wherein: Initiating the image capture mode of the first application is in response to receiving a selection on a user interface of the first application to establish an authenticated session using an encoded image.

5. The method according to claim 1, wherein: The first image and the second image are Quick Response (QR) codes.

6. The method according to claim 1, wherein: The second computing device is executing a different operating system than the first computing device.

7. The method according to claim 1, wherein: The second application and the first application are different instances of the same application.

8. The method according to claim 1, wherein: The network-based services include a federated authentication service.

9. A system for downloading a first application on a first computing device and authenticating a user on the first application using an authenticated session of a second application executing on a second computing device, the system comprising: The first computing device comprises: Hardware processor; a memory device storing instructions that, when executed by the hardware processor, cause the first computing device to perform operations comprising: capturing, in an image capture application of the first computing device, a first image encoding a link for downloading the first application, the first image being displayed by the second application on the second computing device; responsive to capturing the first image, decoding the link; Downloading the first application from the link; In response to downloading the first application, executing the first application, the first application: identifying a session identifier of a session between the second application and the network-based service from communications with the second computing device; providing the session identifier to the network-based service of the first application over a network, the network-based service replacing the first image with a second image on the second computing device; capturing the second image displayed by the second application, the second image being encoded with a secret value; decoding the second image to decode the secret value; and An authenticated session of the user of the first application with the network-based service is established using the secret value.

10. The system according to claim 9, wherein: The operations of identifying the session identifier of the session between the second application and the network-based service from the communications with the second computing device include: Starting an image capture mode of the first application; capturing, in the image capture mode of the first application, the first image displayed by the second application of the second computing device; and Determining that the first image encodes both the link for downloading the first application and the session identifier of the authenticated session between the second application and the network-based service.

11. The system according to claim 10, wherein: The operations also include: responsive to determining that the first image encodes both the link for downloading the first application and the session identifier: identifying the link for downloading the first application; and Responsive to identifying the link for downloading the first application, downloading the first application is avoided.

12. The system according to claim 10, wherein: The operation of initiating the image capture mode of the first application is in response to receiving a selection on a user interface of the first application to establish an authenticated session using the encoded image.

13. The system according to claim 9, wherein: The first image and the second image are Quick Response (QR) codes.

14. The system according to claim 9, wherein: The second computing device is executing a different operating system than the first computing device.

15. The system according to claim 9, wherein: The second application and the first application are different instances of the same application.

Images