Automatic authentication of a mobile device using stored authentication credentials

• US 9,867,048 B2
• Filed: 05/03/2017
• Issued: 01/09/2018
• Est. Priority Date: 09/27/2013
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Metral, Max Edward
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US15/586,099
• Publication Number:
  US 20170238182A1
• Time in Patent Office: 251 Days
• Field of Search: 726 5
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Systems and methods are disclosed which may allow a user having a mobile device to automatically authenticate to a server using a device identifier associated with the mobile device. An access point may be configured to send the device identifier as well as additional identifying information to the server so that the device identifier can be accurately matched to the mobile device. Then, when the mobile device submits a credential during authentication, the device identifier and the credential may be matched such that the next time the server receives the device identifier from the access point, the mobile device may be automatically authenticated.

Claims

1. A method comprising:

receiving, by a system, an initial authentication request from a mobile device that has been detected by an access point, wherein the mobile device is not associated with authentication credentials stored at the system;

in response to authenticating the mobile device, sending, by the system to the mobile device, a packet stream having one or more packet characteristics;

receiving, from the access point, a communication, wherein the communication corresponds to information that is received by the access point from the mobile device subsequent to the sending the packet stream to the mobile device;

storing, by the system, first authentication credentials for the mobile device in response to determining, by the system, that the communication corresponds to the packet stream sent to the mobile device, wherein the determining includes comparing one or more characteristics of the communication with the one or more packet characteristics; and

based on the stored first authentication credentials, automatically authenticating the mobile device in a subsequent instance to the initial authentication request where the mobile device is detected by the access point.

2. The method of claim 1, wherein the one or more packet characteristics comprises a packet characteristic selected from a group consisting of a predetermined packet length and a predetermined packet timing.

3. The method of claim 1, wherein the automatically authenticating is performed without requiring a user of the mobile device to manually submit the first authentication credentials, and wherein the comparing the one or more characteristics of the communication comprises matching a predetermined packet length of the communication with a predetermined packet length of the packet stream.

4. The method of claim 1, wherein the communication comprises a unique device identifier associated with the mobile device, the method further comprising:

associating the unique device identifier with the first authentication credentials.

5. The method of claim 4, wherein the unique device identifier comprises an identifier selected from a group consisting of a media access control (MAC) address and an International Mobile Station Equipment Identity (IMEI) number.

6. The method of claim 1, wherein the access point comprises a device selected from a group consisting of a wireless access point and a mobile phone base station.

7. A non-transitory computer readable medium storing computer-executable instructions, that in response to execution by a server, causes the server to perform operations comprising:

receiving an initial authentication request from a mobile device of a user, the mobile device having been detected by an access point, wherein the mobile device is not associated with authentication credentials stored at the server;

in response to authenticating the mobile device, transmitting, to the mobile device, a packet stream having one or more packet characteristics;

receiving, from the access point, a communication corresponding to information that is received by the access point from the mobile device, the information received by the access point subsequent to the transmitting the packet stream to the mobile device;

storing first authentication credentials for the mobile device in response to determining, by the server, that the communication corresponds to the packet stream sent to the mobile device, wherein the determining includes comparing one or more characteristics of the communication with the one or more packet characteristics;

based on the stored first authentication credentials, automatically authenticating the mobile device in a subsequent instance to the initial authentication request where the mobile device is detected by the access point.

8. The non-transitory computer readable medium of claim 7, wherein the automatically authenticating is performed without requiring the user of the mobile device to manually submit the first authentication credentials, and wherein the comparing the one or more characteristics of the communication comprises matching a predetermined packet length of the communication with a predetermined packet length of the packet stream.

9. The non-transitory computer readable medium of claim 7, wherein the communication comprises a unique device identifier associated with the mobile device, and the unique device identifier comprises an identifier selected from a group consisting of a Media Access Control (MAC) address and an International Mobile Station Equipment Identity (IMEI) number.

10. The non-transitory computer readable medium of claim 7, wherein the packet stream is transmitted to the mobile device via the access point.

11. The non-transitory computer readable medium of claim 10, wherein the one or more packet characteristics comprises a packet characteristic selected from a group consisting of a predetermined packet length and a predetermined packet timing.

12. The non-transitory computer readable medium of claim 7, wherein the communication comprises a unique device identifier associated with the mobile device, and wherein the operations further comprise:

associating the unique device identifier of the mobile device with the stored first authentication credentials.

13. The non-transitory computer readable medium of claim 12, wherein the unique device identifier comprises an identifier selected from a group consisting of a media access control (MAC) address and an International Mobile Station Equipment Identity (IMEI) number.

14. The non-transitory computer readable medium of claim 7, wherein the access point comprises a device selected from a group consisting of a wireless access point and a mobile phone base station.

15. An authentication system, comprising:

a non-transitory memory storing instructions; and

one or more processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising;

receiving an initial authentication request from a mobile device that has been detected by an access point, wherein the mobile device is not associated with authentication credentials stored at the system;

in response to authenticating the mobile device, sending, to the mobile device, a packet stream having one or more packet characteristics;

receive, from the access point a communication, wherein the communication corresponds to information that is received by the access point from the mobile device subsequent to the sending the packet stream to the mobile device;

storing first authentication credentials for the mobile device in response to determining, by the system, that the communication corresponds to the packet stream sent to the mobile device, wherein the determining includes comparing one or more characteristics of the communication with the one or more packet characteristics; and

based on the stored first authentication credentials, automatically authenticating the mobile device in a subsequent instance to the initial authentication request where the mobile device is detected by the access point.

16. The system of claim 15, wherein the one or more packet characteristics comprises a packet characteristic selected from a group consisting of a predetermined packet length and a predetermined packet timing.

17. The system of claim 15, wherein the automatically authenticating is performed without requiring a user of the mobile device to manually submit the first authentication credentials, and wherein the comparing the one or more characteristics of the communication comprises matching a predetermined packet length of the communication with a predetermined packet length of the packet stream.

18. The system of claim 15, wherein the communication comprises a unique device identifier associated with the mobile device, the operations further comprising:

associating the unique device identifier of the mobile device.

19. The system of claim 18, wherein the unique device identifier comprises an identifier selected from a group consisting of a media access control (MAC) address and an International Mobile Station Equipment Identity (IMEI) number.

20. The system of claim 15, wherein the access point comprises a device selected from a group consisting of a wireless access point and a mobile phone base station.