Local device authentication system

Patent metadata

Field	Value
Publication number	US-12537689-B2
Application number	US-202318538911-A
Country	US
Kind code	B2
Filing date	Dec 13, 2023
Priority date	Apr 30, 2020
Publication date	Jan 27, 2026
Grant date	Jan 27, 2026

Abstract

Various embodiments are generally directed to provide a semi-local authentication scheme. A server can transmit one or more encryption mechanisms to a user device, which in turn can transmit the encrypted mechanisms to one or more secondary devices associated with the user device, where the user device and the secondary devices share a local connection. The secondary devices can transmit the one or more encrypted mechanism utilizing one or more one or more decryption mechanisms supplied by the server, and then transmit the result of the decryption, e.g. decrypted codes, back to the user device, which in turn can then transmit a final decrypted code or codes to the server. Upon confirming receipt of the decryption from the user device, the server can authorize access (via the user device) to one or more devices, networks, applications, and/or components.

First claim

What is claimed is:

1 . A method, comprising:
transmitting, by a first device via a first network, an authentication credential to a server; receiving, by the first device via the first network, a plurality of encrypted codes from the server based on the authentication credential; transmitting, by the first device via a second network, respective ones of the encrypted codes to respective ones of a plurality of secondary devices; receiving, by the first device via the second network, a respective decrypted code from each of the plurality of the secondary devices; transmitting, by the first device via the first network, the decrypted codes to the server; and permitting, by the first device, access to a computing resource based on the transmission of the decrypted codes to the server.

2 . The method of claim 1 , wherein the transmission of the decrypted codes to the server causes the server to combine the decrypted codes, the method further comprising:
receiving, by the first device from the server via the first network, an authorization to permit the access to the computing resource.

3 . The method of claim 1 , wherein the second network comprises one or more of a Bluetooth network, an intranet network, a near field communication (NFC) network, and a mesh network.

4 . The method of claim 1 , wherein at least two of the plurality of encrypted codes include a respective portion of an address associated with the server.

5 . The method of claim 4 , further comprising:
combining, by the first device, the portions of the address to generate the address of the server.

6 . The method of claim 5 , wherein the address of the server comprises an internet protocol (IP) address of the server, wherein the decrypted codes are transmitted to the server based on the IP address of the server.

7 . The method of claim 1 , wherein the decrypted codes are received only if the second network exists, wherein the computing resource comprises one or more of: an application, a computing device, or the first network.

8 . A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processor of a first device, cause the processor to:
transmit, via a first network, an authentication credential to a server; receive, via the first network, a plurality of encrypted codes from the server based on the authentication credential; transmit, via a second network, respective ones of the encrypted codes to respective ones of a plurality of secondary devices; receive, via the second network, a respective decrypted code from each of the plurality of the secondary devices; transmit, via the first network, the decrypted codes to the server; and permit access to a computing resource based on the transmission of the decrypted codes to the server.

9 . The computer-readable storage medium of claim 8 , wherein the transmission of the decrypted codes to the server causes the server to combine the decrypted codes, wherein the instructions further cause the processor to:
receive, from the server via the first network, an authorization to permit the access to the computing resource.

10 . The computer-readable storage medium of claim 8 , wherein the second network comprises one or more of a Bluetooth network, an intranet network, a near field communication (NFC) network, and a mesh network.

11 . The computer-readable storage medium of claim 8 , wherein at least two of the plurality of encrypted codes include a respective portion of an address associated with the server.

12 . The computer-readable storage medium of claim 11 , wherein the instructions further cause the processor to:
combine the portions of the address to generate the address of the server.

13 . The computer-readable storage medium of claim 12 , wherein the address of the server comprises an internet protocol (IP) address of the server, wherein the decrypted codes are transmitted to the server based on the IP address of the server.

14 . The computer-readable storage medium of claim 8 , wherein the decrypted codes are received only if the second network exists, wherein the computing resource comprises one or more of: an application, a computing device, or the first network.

15 . A computing apparatus comprising:
a processor; and a memory storing instructions that, when executed by the processor, cause the processor to:
transmit, via a first network, an authentication credential to a server;
receive, via the first network, a plurality of encrypted codes from the server based on the authentication credential;
transmit, via a second network, respective ones of the encrypted codes to respective ones of a plurality of secondary devices;
receive, via the second network, a respective decrypted code from each of the plurality of the secondary devices;
transmit, via the first network, the decrypted codes to the server; and
permit access to a computing resource based on the transmission of the decrypted codes to the server.

16 . The computing apparatus of claim 15 , wherein the transmission of the decrypted codes to the server causes the server to combine the decrypted codes, wherein the instructions further cause the processor to:
receive, from the server via the first network, an authorization to permit the access to the computing resource.

17 . The computing apparatus of claim 15 , wherein the second network comprises one or more of a Bluetooth network, an intranet network, a near field communication (NFC) network, and a mesh network.

18 . The computing apparatus of claim 15 , wherein at least two of the plurality of encrypted codes include a respective portion of an address associated with the server.

19 . The computing apparatus of claim 18 , wherein the instructions further cause the processor to:
combine the portions of the address to generate the address of the server.

20 . The computing apparatus of claim 19 , wherein the address of the server comprises an internet protocol (IP) address of the server, wherein the decrypted codes are transmitted to the server based on the IP address of the server.

Assignees

• Capital One Services Llc

Inventors

• Goodsitt Jeremy Edward
• Walters Austin Grant
• Pham Vincent
• Farivar Reza

Classifications

• H04L9/3226 Primary

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L2209/76

  Proxy, i.e. using intermediary entity to perform cryptographic operations · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L2209/805

  Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor · CPC title

• H04L9/3215 Primary

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title