US 9,754,091 B2 · Restricted accounts on a mobile platform

Abstract

Systems and techniques are provided for restricted accounts on a mobile platform. A request to create a restricted account may be received. The restricted account may be a user account with a restriction. Credentials for the restricted account may be received. A restriction for the restricted account may be received. The restriction may include an access restriction or a lifetime restriction. An access restriction may prevent an application from accessing the restricted account and a lifetime restriction may limit the lifetime of the restricted account. The restricted account may be stored with the credentials and the restriction. A request may be received for a list of user accounts from an application. The restricted account may be determined to include an access restriction that prevents the application from accessing the restricted account. The list of user accounts may be sent to the application and without an identifier for the restricted account.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims36

Dependent claims

A computer-implemented method performed by a data processing apparatus, the method comprising:

receiving a request to create a restricted account on a computing device, wherein the restricted account is a user account with at least one restriction;
receiving credentials for the restricted account, wherein the credentials allow access to one or more of services and data;
receiving the at least one restriction for the restricted account, wherein the at least one restriction comprises an access restriction or a lifetime restriction, wherein the access restriction prevents an application from using the restricted account by preventing the application from accessing the credentials, and the lifetime restriction limits the lifetime of the restricted account by causing deletion of the restricted account based on at least one of a time limit or an event whose occurrence ends a lifetime of the restricted account;
creating the restricted account, wherein the restricted account comprises the credentials and the at least one restriction;
storing the restricted account in a storage device of the computing device as a new user account;
and
when the at least one restriction comprises the lifetime restriction comprising the time limit on the lifetime of the restricted account:
determining an age of the restricted account;
comparing the age of the restricted account to the time limit on the lifetime of the restricted account;
and
deleting the restricted account when the age of the restricted account is equal to or greater than the time limit on the lifetime of the restricted account;
when the at least one restriction comprises the lifetime restriction comprising the indication of the event whose occurrence ends the lifetime of the restricted account:
determining that the event in the lifetime restriction has occurred;
and
deleting the restricted account;
and
when the at least one restriction comprises the access restriction:
receiving a request for a list of user accounts from the application;
determining that the restricted account comprises the access restriction that prevents the requesting application from accessing the restricted account;
and
sending the application the list of user accounts, wherein the list of user accounts omits an identifier for the restricted account.

18 more elements

A computer-implemented system for restricted accounts comprising:

a storage device comprising an account database, the account database comprising a restricted account;
an account manager adapted to receive a request to create a restricted account from a first application, receive credentials, wherein the credentials allow access to one or more of services and data, receive at least one restriction, wherein the at least one restriction comprises an access restriction or a lifetime restriction, wherein the access restriction prevents at least one specified application from using the restricted account by preventing the application accessing the credentials and the lifetime restriction limits the lifetime of the restricted account by deleting the restricted account based on at least one of a time limit or an event whose occurrence ends a lifetime of the restricted account, create and store the restricted account with the credentials and the at least one restriction in the account database of the storage device as a new user account, receive a request for a list of user accounts from a second application, determine if the second application is allowed to access the restricted account based on the at least one restriction, omit an identifier for the restricted account from the list of user accounts if the second application is not permitted to access the restricted account, include an identifier for the restricted account on the list of user accounts if the second application is permitted to access the restricted account, send the list of user accounts to the second application, determine the age of the restricted account, delete the restricted account when the age of the restricted account is equal to or greater than the time limit on the lifetime of the restricted account;
determine the occurrence of an event specified in the at least one restricted account, and delete the restricted account when the event in the lifetime restriction has occurred.

A system comprising:

one or more computers and one or more storage devices storing instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving a request to create a restricted account on a computing device, wherein the restricted account is a user account with at least one restriction;
receiving credentials for the restricted account, wherein the credentials allow access to one or more of services and data;
receiving the at least one restriction for the restricted account, wherein the at least one restriction comprises the access restriction or the lifetime restriction, wherein the access restriction prevents an application from accessing the restricted account by preventing the application from accessing the credentials, and the lifetime restriction limits the lifetime of the restricted account by causing the deletion of the restricted account based on at least one of a time limit or an event whose occurrence ends a lifetime of the restricted account;
creating the restricted account, wherein the restricted account comprises the credentials and the at least one access restriction;
storing the restricted account in a storage device of the computing device as a new user account;
and
when the at least one restriction comprises the lifetime restriction comprising the time limit on the lifetime of the restricted account:
determining an age of the restricted account;
comparing the age of the restricted account to the time limit on the lifetime of the restricted account;
and
deleting the restricted account when the age of the restricted account is equal to or greater than the time limit on the lifetime of the restricted account;
when the at least one restriction comprises the lifetime restriction comprising the indication of the event whose occurrence ends the lifetime of the restricted account:
determining that the event in the lifetime restriction has occurred;
and
deleting the restricted account;
and
when the at least one restriction comprises the access restriction:
receiving a request for a list of user accounts from the application;
determining that the restricted account comprises the access restriction that prevents the requesting application from accessing the restricted account;
and
sending the application the list of user accounts, wherein the list of user accounts omits an identifier for the restricted account.

19 more elements

Dependencies are inferred from the claim text.

Description10,321 words

Summary1,557 words

#Mobile computing devices, such as, for example, smartphones and tablets, may include, as part of a mobile platform used by the mobile computing device, a component, which may be part of the operating system, capable of managing user accounts on the mobile computing device. For example, a user may have an account in an umbrella ecosystem. The umbrella ecosystem may include an application ecosystem from which the user can download, install, and manage application on the mobile computing device, and other services, such as email, cloud storage, maps and navigation, and web search. The user's account in the umbrella ecosystem, or umbrella account, may include credentials such as a username and password that can be used to access the user's data in the umbrella ecosystem. The application ecosystem and other services may each be accessed from the mobile computing device using an associated application. For example, an application store application may be used to access the application ecosystem, and an email application may be used to access the user's email account in the umbrella ecosystem. Because the application ecosystem and other services are part of the same umbrella ecosystem, they may all obtain proper credentials to access the user's data from the umbrella account stored on the mobile computing device.

#The user accounts managed by the component of the mobile platform, for example, the operating system or a separately installed application, of the mobile computing device may be available device-wide. Every application installed on the mobile computing device may have access to any user account stored on the mobile computing device and managed by the component of the mobile platform. For example, when a first user logs-in to their umbrella account on a second user's mobile computing device, the applications installed on the second user's mobile computing device may gain access to the first user's data in the umbrella ecosystem. The email application on the second user's computing device may access the first user's email from the umbrella ecosystem's servers, and may mix the email with the second user's email.

#Some applications may establish their own user accounts on the mobile computing device. These third-party user accounts may not be managed by the component of the mobile platform, and may not be available to any other applications on the mobile computing device. For example, an application may store user account credentials, such as a user name and password or token, with the application's data instead of with the user accounts that are managed by the operating system. Third-party user accounts may be less secure than user accounts managed by a component of the mobile platform, and may be difficult to share among applications.

Brief description of the drawings8 figures

#The accompanying drawings, which are included to provide a further understanding of the disclosed subject matter, are incorporated in and constitute a part of this specification. The drawings also illustrate embodiments of the disclosed subject matter and together with the detailed description serve to explain the principles of embodiments of the disclosed subject matter. No attempt is made to show structural details in more detail than may be necessary for a fundamental understanding of the disclosed subject matter and various ways in which it may be practiced.

#FIG. 1 shows an example system suitable for restricted accounts on a mobile platform according to an implementation of the disclosed subject matter.

#FIG. 2 shows an example arrangement for restricted accounts on a mobile platform according to an implementation of the disclosed subject matter.

Detailed description8,494 words

#Restricted accounts on a mobile platform may be user accounts on a computing device which may be managed by a component of a mobile platform and may include restrictions, including access restrictions and lifetime restrictions. The computing device may be a mobile computing device, such as a smartphone or tablet, which uses the mobile platform, or may be any other suitable computing device that uses the mobile platform, such as a smart television. Restricted accounts may be used, for example, to allow a user to use an umbrella account on a computing device with one specific application associated with an umbrella ecosystem while preventing other applications on the computing device associated with the application ecosystem from using the umbrella account. Restricted accounts may also be used to allow a first user to log-in on a computing device belonging to a second user and use an application requiring an umbrella account without causing all of the first user's umbrella account data to be synced with applications associated with the umbrella ecosystem on the second user's computing device. The first user's restricted account may also be deleted from the second user's computing device when the first user is done using the application, preventing the second user from using or accessing the first user's umbrella account. A single computing device may be shared among a number of users, who may all use restricted accounts on the computing device to keep each user's data segregated and prevent users from accessing other users' accounts and data.

#The access restrictions for a restricted account may limit which applications on the computing device may access and use the restricted account, which may otherwise be available for use by all applications on the computing device. For example, a restricted account may include credentials for an umbrella account and restrictions limiting access to only an advertising management application associated with an umbrella ecosystem. An email application associated with the umbrella ecosystem may be unable to access the restricted account, and may not be able to use credentials for the umbrella ecosystem in the restricted account to access the user's email in the umbrella ecosystem. The advertising management application may be able to access and use the restricted account as if it were an unrestricted umbrella account. A restricted account may have any number of access restrictions. For example, a restricted account may be restricted to use with all applications except for one, or the restricted account may be limited to use with only one application. The access restrictions may be in the form of a whitelist or a blacklist, and may include not only applications currently installed on the same computing device as the restricted account, but any application that may be installed on the computing device, such as applications available through an application ecosystem. The access restrictions for a restricted account may be implemented using scopes in a token created for the restricted account.

#The lifetime restrictions for a restricted account may limit how long the restricted account is stored on the computing device before being deleted. For example, a restricted account may include credentials for an umbrella account and a lifetime restriction causing the account to be deleted after a specified time period, on the completion of a specified action, or on the occurrence of an event. For example, the restricted account may include a lifetime restriction setting the lifetime of the restricted account to one hour from the creation of the restricted account, or a lifetime restriction setting the lifetime of the restricted account to end when the user logs out of the application used to create the account. The restricted account may function as an unrestricted umbrella account until the lifetime of the restricted account is reached, at which point the restricted account may be deleted or disabled. The restricted account may have more than one lifetime restriction. For example, the restricted account may have one lifetime restriction causing the lifetime of the restricted account to end when the application used to create the account is closed, and second lifetime restriction of four hours from creation of the restricted account. This may ensure eventual deletion or disablement of the restricted account if, for example, the user forgets to close or log out of the application. Restricted accounts may also include any combination of access and lifetime restrictions. For example, a restricted account may have access restrictions limiting the restricted to use with one application and a lifetime restriction causing the restricted account to be deleted when the application is closed.

Facts

Application

14/283,793Filed 21 May 2014

Published

US 2015/0339464 A126 Nov 2015

Granted

5 Sep 2017

Term ends

21 May 2034

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification5 codes

G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/102
For controlling access to devices or network resources: entity profiles
G06F
Computing and data processing

Timeline

21 May 2014Application filedUS 14/283,793
21 May 2014Assigned to Google Inc.assignment of assignor's interest
26 Nov 2015PublishedUS 2015/0339464 A1
5 Sep 2017GrantedUS 9,754,091 B2
2 Oct 2017Assigned to Google LLCchange of name
12 Oct 2026TodayWithin its term
21 May 2034Term endsEstimated

Restricted accounts on a mobile platform

Life of this patent

Restricted accounts on a mobile platform

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims36

Description10,321 words

Drawings

Classification5 codes

Life of this patent

Description10,321 words