Multi-device authentication

• US 9,939,908 B2
• Filed: 09/28/2015
• Issued: 04/10/2018
• Est. Priority Date: 09/28/2015
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Lopez Lecube, Tiano Freixas, Miller, Josh, Jaeger, Thomas, Oh, Sam, Zhao, Wenhan, Min, Eric
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/868,243
• Publication Number:
  US 20170093846A1
• Time in Patent Office: 925 Days
• Field of Search: 726 7
• CPC Class Codes: G06F 1/1694 the I/O peripheral being a single or a set of motion sensors for pointer control or gesture input obtained by sensing movements of the portable computer
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 2200/1636 Sensing arrangement for detection of a tap gesture on the housing
• CPC Class Codes: G06F 2203/04808 Several contacts: gestures triggering a specific function, e.g. scrolling, zooming, right-click, when the user establishes several contacts with the surface simultaneously; e.g. using several fingers or a combination of fingers and pen
• CPC Class Codes: G06F 3/017 Gesture based interaction, e.g. based on a set of recognized hand gestures interaction based on gestures traced on a digitiser G06F3/04883
• CPC Class Codes: G06F 3/0487 using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/33 using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A system and method uses multiple devices in concert as security for accessing an account. The system and method may use one or more security measures based on unique gestures, coordinated gestures between two devices, presence of multiple devices, sequence of actions, and other measures to prevent fraud. Additionally, these security measures may be rearranged or changed such that the devices may collaborate to provide access to multiple different accounts.

Claims

1. A computer implemented method for security and authentication of a user based on network communications, the method comprising the steps of:

establishing a communication channel between a first device and a second device, wherein the establishing of the communication channel is performed in response to detecting a physical or an electrical coupling between the first device and the second device;

receiving, via the communication channel and from one or more sensors of the first device, sensor data indicating that a first gesture has been performed with at least the first device, the received sensor data including one or more of;

a distance traveled by the first device to perform the first gesture, a speed of the first device to perform the first gesture, an acceleration of the first device to perform the first gesture, a pressure experienced by the first device to perform the first gesture, or a time duration of the first gesture;

comparing the received sensor data with stored sensor data that indicates a performance of a second gesture, the stored sensor data being stored on the second device;

determining, based on the comparing, whether the first gesture matches the second gesture;

receiving, through the communication channel and in response to a determination that the first gesture matches the second gesture, a first authentication credential from the first device;

comparing the first authentication credential with a second authentication credential that is stored on the second device, wherein the first authentication credential or the second authentication credential includes a user identifier for accessing an account; and

accessing the account via at least one of;

the first authentication credential or the second authentication credential;

wherein;

the second device stores the first authentication credential until a predetermined amount of time is reached; and

the second device deletes the first authentication credential from the second device after a threshold time has elapsed or after the account has been accessed.

2. The method of claim 1, wherein at least one of the first and second devices is implanted into a user of the first device and the second device.

3. The method of claim 1, wherein the received sensor data indicates that the first gesture includes a tapping motion.

4. The method of claim 1, wherein the accessing of the account comprises sending the first authentication credential or the second authentication credential to a third device, and wherein the third device includes a remote server, a point of sales device, or a computing device used for accessing the account.

5. The method of claim 1, wherein one of the first and second authentication credentials includes a user identifier for accessing the account, and the other one of the first and second authentication credentials includes a password associated with the user identifier.

6. The method of claim 1, further comprising:

deleting the first authentication credential from the second device after the account is accessed.

7. The method of claim 1, wherein the one or more sensors are selected from the group consisting of:

a pressure sensor, an accelerometer, a gyroscope, an electromagnetic transceiver, a motion detector, and an infrared emitter.

8. A multi-device security system comprising:

a first device that includes one or more sensors and a first non-transitory memory that stores a first authentication credential, wherein the one or more sensors are configured to detect a first gesture performed by the first device; and

a second device that includes one or more hardware processors and a second non-transitory memory, the second non-transitory memory storing a second authentication credential and sensor data associated with a second gesture, wherein the one or more hardware processors are configured to execute instructions to cause the system to perform operations comprising;

establishing a communication channel between the first device and the second device, wherein the establishing of the communication channel is performed in response to detecting a physical or an electrical coupling between the first device and the second device;

receiving, via the communication channel and from the one or more sensors of the first device, sensor data from the first device, the sensor data indicating that the first gesture has been performed with at least the first device, the received sensor data including one or more of;

a distance traveled by the first device to perform the first gesture, a speed of the first device to perform the first gesture, an acceleration of the first device to perform the first gesture, a pressure experienced by the first device to perform the first gesture, or a time duration of the first gesture;

comparing the received sensor data with the sensor data stored on the second device, the stored sensor data indicating a performance of a second gesture;

determining, based on the comparing, whether the first gesture matches the second gesture;

receiving, through the communication channel and in response to a determination that the first gesture matches the second gesture, the first authentication credential from the first device;

comparing the first authentication credential with the second authentication credential that is stored on the second non-transitory memory, wherein the first authentication credential or the second authentication credential includes a user identifier for accessing an account; and

accessing the account via at least one of;

the first authentication credential or the second authentication credential;

wherein;

the second device stores the first authentication credential in the second non-transitory memory until a predetermined amount of time is reached; and

the second device deletes the first authentication credential from the second non-transitory memory after a threshold time has elapsed or after the account has been accessed.

9. The multi-device security system of claim 8, wherein one of the first and second authentication credentials includes a password associated with the user identifier.

10. The multi-device security system of claim 8, wherein the first gesture is performed by the first device relative to the second device, and wherein the one or more sensors are selected from the group consisting of:

a pressure sensor, an accelerometer, a gyroscope, an electromagnetic transceiver, a motion detector, and an infrared emitter.

11. One or more non-transitory computer readable media having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

establishing a communication channel between a first device and a second device, wherein the establishing of the communication channel is performed in response to detecting a physical or an electrical coupling between the first device and the second device;

receiving, via the communication channel and from one or more sensors of the first device, sensor data indicative of a first gesture performed with at least the first device, the received sensor data including one or more of;

a distance traveled by the first device to perform the first gesture, a speed of the first device to perform the first gesture, an acceleration of the first device to perform the first gesture, a pressure experienced by the first device to perform the first gesture, or a time duration of the first gesture;

comparing the received sensor data with stored sensor data indicative of a performance of a second gesture, the stored sensor data being stored on the second device;

determining, based on the comparing, whether the first gesture matches the second gesture;

receiving, through the communication channel and in response to a determination that the first gesture matches the second gesture, a first authentication credential from the first device;

comparing the first authentication credential with a second authentication credential that is stored on the second device, wherein the first authentication credential or the second authentication credential includes a user identifier for accessing an account; and

accessing the account via at least one of;

the first authentication credential or the second authentication credential;

wherein;

the second device stores the first authentication credential until a predetermined amount of time is reached; and

the second device deletes the first authentication credential from the second device after a threshold time has elapsed or after the account has been accessed.

12. The one or more non-transitory computer readable media of claim 11, wherein the operations further comprise:

deleting the first authentication code from the second device after the account is accessed.

13. The one or more non-transitory computer readable media of claim 11, wherein at least some of the one or more sensors of the first device are implanted in a user.

14. The one or more non-transitory computer readable media of claim 11, wherein the first gesture is performed by the first device relative to the second device, and wherein the one or more sensors are selected from the group consisting of:

a pressure sensor, an accelerometer, a gyroscope, an electromagnetic transceiver, a motion detector, and an infrared emitter.

15. The one or more non-transitory computer readable media of claim 11, wherein the accessing the account comprises communicating the first authentication credential or the second authentication credential to a third device.

16. The one or more non-transitory computer readable media of claim 15, wherein one of the first and second authentication codes includes a user identifier for accessing the account, and the other one of the first and second authentication codes includes a password associated with the user identifier, and wherein the third device includes a remote server, a point of sales device, or a computing device used for accessing the account.