Google Inc.

Paypal, Inc.

Ebay, Incorporated

Scott Atwood

Igor Yefimov

Jeffrey William Hamilton

Michael Galpin

Jon Christian Boekenoogen

Colin Albright McDonough

Artem Malyshev

Systems and methods for passporting credentials provide a mechanism by which a native app on a client device can invoke a service provider's core web site web addresses (URL) while keeping the existing session active and shared between the two experiences (native app and web flow) so that the end user does not need to re-login at each context switch. The mechanism can include a unique way for the web flow context to communicate conditions and pass control back to the native app context of the shared session.

Passporting credentials between a mobile app and a web browser

To authenticate a service request, a first server receives a handshake request from a client application. The first server transmits a first nonce to the client application. The first server sends a second nonce and the handshake request to a second server. The second nonce may be a key for decrypting the first nonce, or it may be a separate nonce. The first server stores a result of an operation performed on the first and second nonces. The client application receives a push notification with the second nonce from the second server via a secure and authenticated communication channel. The client application also performs an operation on the nonces to generate a candidate result, which it sends to the first server. If the candidate result matches the stored result, the first server will send the client application a token that grants access to a service.

Mechanism for achieving mutual identity verification via one-way application-device channels

An application service system receives, from a merchant service system, an application program code comprising identifying information. The identifying information is extracted and the application is distributed for operation on a user device. A user interacts with the application, creating an access request that is transmitted to the application service system along with the extracted identifying information. The application service system transmits an access token to the user device comprising the received identifying information. The user device transmits the access token with a service request to the application service system. The application service system compares the identifying information from the access token to the identifying information extracted from the application program code received from the merchant services system. If the identifying information matches, the service request is processed. If the identifying information does not match, the service request is denied and an error message is transmitted to the user device.

Confirming the identity of integrator applications

Systems and methods for passporting credentials provide a mechanism by which a native app on a client device can invoke a service provider's core web site web addresses (URL) while keeping the existing session active and shared between the two experiences (native app and web flow) so that the end user does not need to re-login at each context switch. The mechanism can include a unique way for the web flow context to communicate conditions and pass control back to the native app context of the shared session. Embodiments may operate by authenticating a device session from a native app executing on a client device producing a device session token; passing the device session token from a native app to an embedded browser to authenticate a user when entering a web flow; and entering the web flow, according to the session token, on an embedded browser driven by the native app so that the user encounters a single shared session (device session and web session) running at least two parallel secure communication interactions with an infrastructure.

A requesting application transmits a session key request comprising request parameters to an application authentication system, which generates a random nonce and current timestamp, calculates a session key, and transmits the session key and session key parameters to the requesting application. The requesting application creates a pasteboard, generates a random challenge, calculates an output of a function with the random challenge as input, posts the output on the pasteboard, launches an invited application, and transmits the session key parameters and the pasteboard name to the invited application with which the user initiates an authentication session by providing credentials. The invited application requests a session key from the application authentication system, which confirms the authentication session, calculates a second session key, and transmits it to the invited application, which accesses the pasteboard, determines the random challenge, and posts the function output at an expected value. The requesting application confirms the output.

Growing community of inventors

Campbell, CA, United States of America

Scott Atwood