Location determination for user authentication

• US 10,158,627 B2
• Filed: 11/16/2017
• Issued: 12/18/2018
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Thompson, Micheal
• Primary Examiner(s): Lewis, Lisa C
• Application Number:
  US15/814,653
• Publication Number:
  US 20180097796A1
• Time in Patent Office: 397 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

User authentication techniques based on geographical locations associated with a client device are provided. An example method for authentication of the client device includes receiving an authentication request from the client device. The method may include establishing current geographical location of the client device based on metadata received from the client device. The method may further include establishing a trusted tolerance geographical area based on historical location area associated with the client device. After establishing the trusted tolerance geographical area, the method may proceed with determining whether the current geographical location of the client device is within the trusted tolerance geographical area. The method may further include authenticating the client device based on the determination that the current geographical location of the client device is within the trusted tolerance geographical area.

Claims

1. A method for authentication of a client device, the method comprising:

receiving, by at least one processor of a host machine, an authentication request from the client device to access a resource provided by the host machine, the host machine being located remotely with respect to the client device;

determining, by the at least one processor of the host machine, a first distance between the host machine and the client device;

based on the authentication request, instructing, by the at least one processor of the host machine, a further host machine of two or more host machines to determine a second distance between the further host machine and the client device, the further host machine providing data associated with the second distance to the host machine;

establishing, by the at least one processor of the host machine, a current geographical location of the client device by a triangulation of the client device, the host machine, and the further host machine based on the first distance, the second distance, and a known distance between the host machine and the further host machine;

establishing, by the at least one processor, a trusted tolerance geographical area based on at least a historical location area associated with the client device, the trusted tolerance geographical area being circumscribed by a plurality of points, the plurality of points being at varying respective distances from each of the first host machine and the second host machine;

determining, by the at least one processor, whether the current geographical location of the client device is within the trusted tolerance geographical area; and

authenticating the client device, by the at least one processor, based on the determination that the current geographical location of the client device is within the trusted tolerance geographical area.

2. The method of claim 1, wherein a location of the host machine and a location of the further host machine are known.

3. The method of claim 2, wherein the triangulation includes:

calculating trip times (RTTs) of test messages exchanged between the client device and the host machine and between the client device and the further host machine;

determining the location of the client device by forming triangles between the client device, the host machine, and the further host machine.

4. The method of claim 1, wherein the trusted tolerance geographical area is based on historical locations of the client device.

5. The method of claim 4, wherein the authenticating the client device is further based on time stamps associated with the current geographical location and the historical locations of the client device.

6. The method of claim 5, wherein the time stamps are used to establish a likelihood of moving the client device between a historical location and the current geographical location within a period of time.

7. The method of claim 1, further comprising updating the trusted tolerance geographical area in response to the authentication of the client device.

8. The method of claim 1, wherein the trusted tolerance geographical area is defined based on the historical locations.

9. The method of claim 1, further comprising receiving metadata from the client device, wherein the metadata include an Internet Protocol version 4 (IPv4) address or an Internet Protocol version 6 (IPv6) address associated with the client device.

10. The method of claim 1, further comprising receiving user credentials, the user credentials including a user login and a password.

11. A system for authentication of a client device, the system comprising:

a processor of a host machine, wherein the processor is a hardware processor configured to;

receive an authentication request from the client device to access a resource provided by the host machine, the host machine being located remotely with respect to the client device;

determine a first distance between the host machine and the client device;

based on the authentication request, instruct a further host machine of two or more host machines to determine a second distance between the further host machine and the client device, the further host machine providing data associated with the second distance to the host machine;

establish a current geographical location of the client device by a triangulation of the client device, the host machine, and the further host machine based on the first distance, the second distance, and a known distance between the host machine and the further host machine;

establish a trusted tolerance geographical area based on at least a historical location area associated with the client device, the trusted tolerance geographical area being circumscribed by a plurality of points, the plurality of points being at varying respective distances from each of the first host machine and the second host machine;

determine whether the current geographical location of the client device is within the trusted tolerance geographical area; and

authenticate the client device based on the determination that the current geographical location of the client device is within the trusted tolerance geographical area; and

a database configured to store at least data associated with the client device.

12. The system of claim 11, wherein a location of the host machine and a location of the further host machine are known.

13. The system of claim 12, wherein the triangulation includes:

calculating trip times (RTTs) of test messages exchanged between the client device and the host machine and between the client device and the further host machine;

determining the location of the client device by forming triangles between the client device, the host machine and the further host machine.

14. The system of claim 11, wherein the trusted tolerance geographical area is based on historical locations of the client device.

15. The system of claim 14, wherein the authenticating the client device is further based on time stamps associated with the current geographical location and the historical locations of the client device.

16. The system of claim 15, wherein the time stamps are used to establish a likelihood of moving the client device between a historical location and the current geographical location within a period of time.

17. The system of claim 11, wherein the processor is further configured to update the trusted tolerance geographical area in response to the authentication of the client device.

18. The system of claim 11, wherein the trusted tolerance geographical area is defined based on the historical locations.

19. The system of claim 11, wherein the processor is further configured to receive metadata from the client device and wherein the metadata include an Internet Protocol version 4 (IPv4) address or Internet Protocol version 6 (IPv6) address associated with the client device.

20. A system for authentication of a client device, the system comprising:

a processor of a host machine of two or more host machines, wherein the processor is a hardware processor configured to;

receive an authentication request from the client device to access a resource provided by the host machine, the host machine being located remotely with respect to the client device;

determine a first distance between the host machine and the client device;

based on the authentication request, instruct a further host machine of two or more host machines to determine a second distance between the further host machine and the client device, the further host machine providing data associated with the second distance to the host machine;

establish a current geographical location of the client device by a triangulation of the client device, the host machine, and the further host machine based on the first distance, the second distance, and a known distance between the host machine and the further host machine, wherein the triangulation includes;

calculating trip times (RTTs) of test messages exchanged between the client device and the host machine and the further host machine; and

determining the location of the client device by forming triangles between the client device, the host machine, and the further host machine;

establish a trusted tolerance geographical area based on at least a historical location area associated with the client device, the trusted tolerance geographical area being circumscribed by a plurality of points, the plurality of points being at varying respective distances from each of the first host machine and the second host machine;

determine whether the current geographical location of the client device is within the trusted tolerance geographical area;

authenticate the client device based on the determination that the current geographical location of the client device is within the trusted tolerance geographical area; and

update the trusted tolerance geographical area in response to the authentication of the client device; and

a database configured to store at least data associated with the client device.