Authentication based on geo-location history

• US 10,212,587 B2
• Filed: 04/20/2015
• Issued: 02/19/2019
• Est. Priority Date: 12/15/2006
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Bentley, Jon Louis, Erhart, George William, O'Gorman, Lawrence, Sammon, Michael J., Skiba, David Joseph
• Primary Examiner(s): Appiah, Charles N
• Assistant Examiner(s): Donado, Frank E
• Application Number:
  US14/690,840
• Publication Number:
  US 20150230086A1
• Time in Patent Office: 1,401 Days
• Field of Search: None
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

Methods and apparatus are disclosed for authenticating a user based on the geo-location history of a geo-location-enabled wireless device (e.g., a GPS-enabled wireless telecommunications terminal, a smart card, an RFID tag, etc.). In a first illustrative embodiment, a user of a geo-location-enabled wireless telecommunications terminal (e.g., a GPS-enabled cell phone, a GPS-enabled notebook computer, etc.) who attempts to access a restricted resource is challenged with one or more questions that are generated from the terminal'"'"'s geo-location history. In a second illustrative embodiment, a user of a data-processing system who attempts to access a restricted resource is asked to provide a username Z. The user is then challenged with one or more questions that are generated from the geo-location history of a wireless device that is associated with username Z (e.g., a cell phone that belongs to the user whose username is Z, etc.).

Claims

1. A method comprising:

receiving a request for a restricted resource, the request originating from a first device having a first device identifier;

accessing a user identifier associated with the first device identifier;

accessing a geo-location history associated with a second device identifier of a second device, wherein the second device identifier is associated with the user identifier and wherein at least a portion of the geo-location history is provided by the second device reporting locations of the second device determined by the user moving from place to place when in possession of the second device, and wherein the device having the first device identifier is different from the second device having the second device identifier, the geo-location history comprising a number of entries;

generating, via a processor, an authentication challenge comprising a query selected to have an associated successful response comprising the at least one entry in the geo-location history;

presenting the authentication challenge to the first device; and

granting access to the restricted resource upon determining that the authentication challenge was successful.

2. The method of claim 1, wherein the user identifier is one of a social security number and an account number.

3. The method of claim 1, wherein the second device identifier is one of an Internet protocol address and a telephone number.

4. The method of claim 1, wherein the table is an ownership database.

5. The method of claim 1, wherein the geo-location history is retrieved from a geo-location history database.

6. The method of claim 1, further comprising:

inferring that the geo-location history associated with the second device identifier is a user geo-location history of a user associated with the user identifier.

7. The method of claim 1, further comprising:

receiving a response to the authentication challenge from a user associated with the user identifier, the response relating to a personal geo-location history of the user; and

determining whether the authentication challenge is successfully met by comparing the geo-location history with the response.

8. The method of claim 7, further comprising:

restricting access to a resource on the first device when the authentication challenge is not successfully met.

9. A system comprising:

a processor to;

receive a request for a restricted resource, the request originating from a first device having a first device identifier;

access a user identifier associated with the first device identifier;

access a table comprising a plurality of user identifiers, each of the plurality of user identifiers being matched with a respective device identifier, to identify a second device identifier associated with the user identifier and wherein the second device identifier is associated with a second device different from the first device;

retrieve a geo-location history associated with the second device identifier, and comprising a number of entries, wherein at least a portion of the geo-location history is provided by the second device reporting locations of the second device determined by the user moving from place to place when in possession of the second device;

generate an authentication challenge comprising a query selected to have an associated successful response comprising the at least one entry in the geo-location history;

present the authentication challenge to the first device; and

grant access to the restricted resource upon determining that the authentication challenge was successful.

10. The system of claim 9, wherein the user identifier is one of a social security number and an account number.

11. The system of claim 9, wherein the second device identifier is one of an Internet protocol address and a telephone number.

12. The system of claim 9, wherein the table is an ownership database.

13. The system of claim 9, wherein the geo-location history is retrieved from a geo-location history database.

14. The system of claim 9, the processor further infers that the geo-location history associated with the second device identifier is a user geo-location history of a user associated with the user identifier.

15. The system of claim 9, the processor further:

receives a response to the authentication challenge from a user associated with the user identifier, the response relating to a personal geo-location history of the user; and

determines whether the authentication challenge is successfully met by comparing the geo-location history with the response.

16. The system of claim 9, the processor further restricts access to a resource on the second device when the authentication challenge is not successfully met.

17. A system comprising:

means to receive a request for a restricted resource, the request originating from a first device having a first device identifier;

means to access a user identifier associated with the first device identifier;

means to access a table comprising a plurality of user identifiers, each of the plurality of user identifiers being matched with a respective device identifier, to identify a second device identifier associated with the user identifier and wherein the second device identifier is associated with a second device different from the first device;

wherein at least a portion of the geo-location history is provided by the second device reporting locations of the second device determined by the user moving from place to place when in possession of the second device;

means to retrieve a geo-location history associated with the second device identifier, and the geo-location history comprising a number of entries, wherein at least a portion of the geo-location history is provided by the second device reporting locations of the second device determined by the user moving from place to place when in possession of the second device;

means to generate, via a processor, an authentication challenge comprising a query selected to have an associated successful response comprising the at least one entry in the geo-location history;

means to present the authentication challenge to the first device; and

means to grant access to the restricted resource upon determining that the authentication challenge was successful.

18. The system of claim 17, further comprising:

means to infer that the geo-location history associated with the second device identifier is a user geo-location history of a user associated with the user identifier.

19. The system of claim 17, further comprising:

means to receive a response to the authentication challenge from a user associated with the user identifier, the response relating to a personal geo-location history of the user; and

means to determine whether the authentication challenge is successfully met by comparing the geo-location history associated with the second device identifier with the response.

20. The system of claim 17, further comprising:

means to restrict access to a resource on the second device when the authentication challenge is not successfully met.