# US 10,122,697 B2 · Native authentication experience with failover

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,697 B2
- Document ID: US10122697B2
- Status: Granted
- Kind: B2
- Application number: 15/475,841
- Filed: 2017-03-31
- Published: 2017-07-20
- Granted: 2018-11-06
- Earliest claimed: 2015-01-05
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Yogesh Vilas Golwalkar; Anuj Joshi; Bharath Kumar Bhimanaik; Lorne Millwood; Carl Lucian Poston, IV
- Web page: https://patentgrep.com/patent/US10122697B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 21/44: Program or device authentication
- G06Q 30/0609: {Qualifying participants for shopping transactions (payment transaction verification G06Q20/401)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 2221/2117: User registration
- H04L 9/321: {involving a third party or a trusted authority}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Disclosed are various embodiments for providing a native authentication experience with failover. A network service authenticates a first application executed in a computing device in a first instance using one or more authentication factors received via a platform-specific application programming interface that is native to the computing device. After a change to how authentication is performed by the network service, the network service authenticates the first application in a second instance via code-based linking with a second application that is authenticated.

## Claims

### Claim 1

A non-transitory computer-readable medium embodying a network service executable in at least one computing device, wherein when executed the network service causes the at least one computing device to at least:
authenticate a first application executed in a client computing device in a first instance using at least one authentication factor received via a platform-specific application programming interface that is native to the client computing device;
implement a change to how authentication is performed by the network service after the first application is authenticated in the first instance; and
after the change to how authentication is performed by the network service is implemented, authenticate the first application via code-based linking with a second application that is authenticated.

### Claim 2 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the change is a modification to the platform-specific application programming interface.

### Claim 3 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the second application is a browser.

### Claim 4

A system, comprising:
at least one computing device; and
a network service executable in the at least one computing device, wherein when executed the network service causes the at least one computing device to at least:
authenticate a first application executed in a computing device in a first instance using at least one authentication factor received via a platform-specific application programming interface that is native to the computing device; and
after a change to how authentication is performed by the network service, authenticate the first application in a second instance via code-based linking with a second application that is authenticated.

### Claim 5 (depends on 4)

The system of claim 4, wherein the change to how authentication is performed by the network service comprises requiring an authentication factor that was previously not required.

### Claim 6 (depends on 4)

The system of claim 4, wherein the change to how authentication is performed by the network service comprises requiring a hardware configuration of the computing device that was previously not required.

### Claim 7 (depends on 4)

The system of claim 4, wherein the network service provides a first authentication version identifier to the first application in the first instance, and the network service provides a second authentication version identifier to the first application in the second instance.

### Claim 8 (depends on 4)

The system of claim 4, wherein the first application is authenticated in the second instance via code-based linking in response to determining that the first application does not support the change to how authentication is performed.

### Claim 9 (depends on 4)

The system of claim 4, wherein the first application is authenticated in the first instance in response to determining that the first application supports a native authentication approach.

### Claim 10 (depends on 4)

The system of claim 4, wherein authenticating the first application in the second instance via code-based linking further comprises:
providing a code to the first application; and
receiving the code from the second application that is authenticated.

### Claim 11 (depends on 10)

The system of claim 10, wherein authenticating the first application in the second instance via code-based linking further comprises providing a uniform resource locator to the first application in association with the code.

### Claim 12 (depends on 10)

The system of claim 10, wherein the code comprises at least one of: a quick-response (QR) code or a barcode.

### Claim 13

A method, comprising:
implementing, via at least one of one or more computing devices, a change in how authentication is performed by the one or more computing devices;
receiving, via at least one of one or more computing devices, an authentication request from a first application;
determining, via at least one of the one or more computing devices, that the authentication request is not supported;
providing, via at least one of the one or more computing devices, a code to the first application; and
authenticating, via at least one of the one or more computing devices, the first application in response to receiving the code from a second application that is authenticated.

### Claim 14 (depends on 13)

The method of claim 13, wherein determining that the authentication request is not supported further comprises determining that a secure connection cannot be established with the first application.

### Claim 15 (depends on 13)

The method of claim 13, wherein the authentication request is generated by a platform-specific application programming interface native to a computing device upon which the first application is executed.

### Claim 16 (depends on 13)

The method of claim 13, wherein the first application is executed by a first computing device, and the second application is executed by a second computing device.

### Claim 17 (depends on 13)

The method of claim 13, wherein the authentication request includes at least one authentication factor received via a platform-specific application programming interface.

### Claim 18 (depends on 13)

The method of claim 13, wherein implementing the change in how authentication is performed by the one or more computing devices further comprises removing, via at least one of one or more computing devices, support for the authentication request.

### Claim 19 (depends on 13)

The method of claim 13, wherein implementing the change in how authentication is performed by the one or more computing devices further comprises requiring, via at least one of one or more computing devices, an authentication factor that is not supported by the first application.

### Claim 20 (depends on 13)

The method of claim 13, wherein implementing the change in how authentication is performed by the one or more computing devices further comprises removing, via at least one of one or more computing devices, support for an authentication factor that is required by the first application.