Geolocation-based authentication credentials

Patent metadata

Field	Value
Publication number	US-10148668-B2
Application number	US-201715415252-A
Country	US
Kind code	B2
Filing date	Jan 25, 2017
Priority date	Jan 25, 2017
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

Provided is process including receiving a request to authenticate a user; sending instructions to present an authentication user interface including a geographic map; receiving geolocations on the geographic map selected by the user; comparing the geolocations to a sequence of geolocations in an authentication credential to determine whether to authenticate the user.

First claim

What is claimed is:

1. An authentication system, comprising:
one or more processors; and
memory storing instructions that when executed by at least some of the processors effectuates operations comprising:
receiving, via a network, a request to authenticate a user of a computing device;
sending, via the network, the computing device instructions to present an authentication user interface, the authentication user interface including a geographic map and instructions that cause the computing device to indicate geolocations selected by the user within the geographic map;
receiving, via the network, a user identifier;
receiving, via the network, geolocations on the geographic map selected by the user and a sequence in which the geolocations were selected;
accessing, based on the user identifier, a record corresponding to the user and having an authentication credential of the user, wherein the authentication credential specifies a sequence of geolocations;
comparing the geolocations on the geographic map selected by the user and sequence in which the geolocations were selected to the sequence of geolocations in the authentication credential to determine whether to authenticate the user;
sending, via the network, a result of the determination of whether to authenticate the user, wherein the result of the determination is based on whether the user is able to demonstrate knowledge of the sequence of geolocations of the authentication credential.

2. The system of claim 1 , wherein:
the user interface is presented in a web browser;
the user identifier:
is received before sending the authentication user interface; and
is received as a result of sending instructions to the computing device to retrieve a value from persistent browser-accessible memory;
uniquely identifies the user among more than 10 , 000 users having authentications credentials stored in a data repository with the record;

the operations comprise, before sending instructions to present the geographic map, and after accessing the record, determining a map extent based on the sequence of geolocations of the authentication credential, wherein:
the map extent has a zoom amount,
the zoom amount is determined based on a geolocation type of at least some of the sequence of geolocations of the authentication credential,
the geolocation type corresponds to a specificity by which corresponding geolocations are identified and being within a hierarchy of geolocation types of varying specificity with respect to geographic area;

the instructions to present an authentication user interface comprise instructions to:
retrieve some images from cache memory of the computing device, the images corresponding to a plurality of image tiles from which the geographic map is formed;
present pan and zoom interfaces by which the user may cause the displayed geographic map to pan and zoom, respectively;
after a pan or zoom request, determining that image tiles added to the map extent as a result of pan or zoom request are not stored in cache memory and, in response, sending a request for the image tiles added to the map extent along with image tiles not added to the map extent to obfuscate the direction of the pan or zoom;
present a map view selector by which the user requests one of a plurality of different styles of maps including a satellite view;
detect clicking or touching events on a display screen and within the geographic map and inputting the events to an event handler operative to:
determine a geolocation by transforming pixel coordinates into corresponding geographic coordinates or a geolocation;
salt and encrypt the geographic coordinates or geolocation to produce an encrypted value; and
send the encrypted value over the network;

comparing the geolocations on the geographic map selected by the user comprises:
decrypting encrypted values and parsing geographic coordinates or geolocations from salted values; and
either determining that each geographic coordinate is within a geolocation in the authentication credential having the same order in the sequence of the authentication credential, or determining that each geolocation matches the geolocation in the authentication credential having the same order in the sequence of the authentication credential; and

sending a result of the determination comprises sending a redirect uniform resource identifier having an access token to the computing device.

3. The system of claim 1 , the operations comprising:
receiving text indicating a subset of the geolocations in the authentication credential, the text having been typed by the user in a text box interface of the user interface specified by the instructions to present the authentication user interface;
converting the text into one or more geolocations identified by typed text, wherein:
comparing comprises comparing the sequence of geolocations in the authentication credential to both the geolocations identified by the typed text and geolocations selected on the geographic map by the user touching or clicking on the geolocations.

4. The system of claim 3 , wherein comparing the sequence of locations in the authentication credential to both the geolocations identified by typed text and geolocations selected on the geographic map by the user touching or clicking on the geolocations comprises:
determining a plurality of candidate sequences combining the geolocations identified by the typed text and geolocations selected on the geographic map by the user touching or clicking on the geolocations; and
determining whether any of the candidate sequences match the sequence of geolocations of the authentication credential.

5. The system of claim 4 , wherein the candidate sequences include every permutation of sequences by which the geolocations identified by the typed text and geolocations selected on the geographic map by the user touching or clicking on the geolocations are ordered in combination.

6. The system of claim 3 , wherein:
the text box interface is configured by the instructions to present the authentication user interface to not display typed characters after a threshold duration of time after each typed character is typed by the user.

7. The system of claim 3 , wherein the typed text indicating a subset of the geolocations is less than a full name of the geolocation indicated by the typed text and has more than a threshold amount of characters of the full name of the geolocation indicated by the typed text.

8. The system of claim 1 , wherein:
at least some of the geolocations on the geographic map selected by the user are received as coordinates;
the operations comprise:
after receiving the at least some of the geolocations on the geographic map selected by the user, determining nominal geolocation identifiers corresponding to received coordinates, the nominal geolocation identifiers being different from coordinates, uniquely identifying geolocations, and some nominal geolocation identifiers specifying geographic regions, wherein the nominal geolocation identifiers are determined by:
determining a respective next geolocation in the authentication credential sequence of geolocations;
determining a respective geolocation type within a hierarchical arrangement of geolocation types of the next geolocation; and
based on the geolocation type, selecting the respective nominal geolocation identifier from among a respective plurality of identifiers of overlapping geolocations, some of the overlapping geolocations being sub-regions within larger regions;

the authentication credential sequence of geolocations specifies a sequence of nominal geolocation identifiers; and
comparing the geolocations on the geographic map selected by the user comprises determining whether

Assignees

• Ca Inc

Inventors

• Bandi Sreenivasulu
• Kumar Gaurav
• Kumar Mitta Sarath
• Mokhinuddeen Shaik

Classifications

• H04W12/06

  Authentication · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F16/29

  Geographical information databases · CPC title

• H04L63/107 Primary

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title