User privacy protected location-based authentication on mobile devices

Patent metadata

Field	Value
Publication number	US-2018019986-A1
Application number	US-201615208382-A
Country	US
Kind code	A1
Filing date	Jul 12, 2016
Priority date	Jul 12, 2016
Publication date	Jan 18, 2018
Grant date	—

Abstract

Techniques for implementing location-based authentication in a computing device are provided. An example method according to these techniques includes binding location authentication information to an authentication key for a relying party (RP) application, receiving a request from the RP application for a signed authentication response, obtaining current location information for the computing device, authenticating the current location information for the computing device based on the location authentication information bound to the authentication key, and providing, to the RP application by the computing device, the signed authentication response in response to the authenticating the current location information for the computing device, wherein the signed authentication response is signed using the authentication key bound to the location authentication information.

First claim

What is claimed is:

1 . A method of implementing location based authentication in a computing device, the method comprising:
binding location authentication information to an authentication key for a relying party (RP) application; receiving a request from the RP application for a signed authentication response; obtaining, at the computing device, current location information for the computing device; authenticating, at the computing device, the current location information for the computing device based on the location authentication information bound to the authentication key; and providing, to the RP application by the computing device, the signed authentication response in response to the authenticating the current location information for the computing device, wherein the signed authentication response is signed using the authentication key bound to the location authentication information.

2 . The method of claim 1 , further comprising providing the signed authentication response without providing the current location information to the RP application.

3 . The method of claim 1 , further comprising generating the location authentication information at the computing device, wherein the location authentication information is indicative of one or more allowed locations for transactions of the RP application.

4 . The method of claim 1 , wherein binding location authentication information to an authentication key for a relying party (RP) application comprises binding location information associated with multiple different locations to the authentication key.

5 . The method of claim 1 , wherein binding location authentication information to an authentication key for a relying party (RP) application further comprises:
binding first location authentication information to a first authentication key for a first transaction of the RP application; and binding second location authentication information to a second authentication key for a second transaction of the RP application, wherein the second location authentication information is different than the first location authentication information.

6 . The method of claim 1 , wherein receiving the request from the RP application for the signed authentication response further comprises:
receiving the request from the RP application for the signed authentication response for a particular transaction of the RP application, wherein the particular transaction comprises one of the first transaction or the second transaction.

7 . The method of claim 1 , wherein authenticating the current location information for the computing device based on the location authentication information bound to the authentication key further comprises authenticating the current location information for the computing device based on bound location authentication information for the particular transaction, wherein the bound location authentication information for the particular transaction comprises one of the first location authentication information or the second location authentication information.

8 . The method of claim 1 , wherein providing the signed authentication response in response to the authenticating the current location information for the computing device further comprises signing the signed authentication response using the authentication key corresponding to the particular transaction, wherein the authentication key corresponding to the particular transaction comprises one of the first authentication key bound with the first location authentication information or the second authentication key bound with the second location authentication information.

9 . The method of claim 1 further comprising receiving the current location information for the computing device from a location authenticator trusted application of the computing device.

10 . The method of claim 1 , further comprising:
binding additional authentication information to the authentication key for the relying party (RP) application; authenticating the additional authentication information for the apparatus based on the additional authentication information bound to the authentication key; and providing, to the RP application by the computing device, the signed authentication response in response to the authenticating the current location information and the additional authentication information for the computing device, wherein the signed authentication response is signed using the authentication key bound to the location authentication information and the additional authentication information.

11 . The method of claim 9 , wherein the additional authentication information comprises biometric information, device state information, authorization credentials, or a combination thereof

12 . An apparatus comprising:
means for binding location authentication information to an authentication key for a relying party (RP) application; means for receiving a request from the RP application for a signed authentication response; means for obtaining, at the apparatus, current location information for the apparatus; means for authenticating, at the apparatus, the current location information for the apparatus based on the location authentication information bound to the authentication key; and means for providing, to the RP application by the apparatus, the signed authentication response in response to the authenticating the current location information for the apparatus, wherein the signed authentication response is signed using the authentication key bound to the location authentication information.

13 . The apparatus of claim 12 , further comprising means for providing the signed authentication response without providing the current location information to the RP application.

14 . The apparatus of claim 12 , further comprising means for generating the location authentication information at the apparatus, wherein the location authentication information is indicative of one or more allowed locations for transactions of the RP application.

15 . The apparatus of claim 12 , wherein the means for binding location authentication information to an authentication key for a relying party (RP) application comprises means for binding location information associated with multiple different locations to the authentication key.

16 . The apparatus of claim 12 , wherein the means for binding location authentication information to an authentication key for a relying party (RP) application further comprises:
means for binding first location authentication information to a first authentication key for a first transaction of the RP application, and means for binding second location authentication information to a second authentication key for a second transaction of the RP application, wherein the second location authentication information is different than the first location authentication information.

17 . The apparatus of claim 12 , wherein the means for receiving the request from the RP application for the signed authentication response further comprises:
means for receiving the request from the RP application for the signed authentication response for a particular transaction of the RP application, wherein the particular transaction comprises one of the first transaction or the second transaction.

18 . The apparatus of claim 12 , wherein the means for authenticating the current location information for the computing device based on the location authentication information bound to the authentication key further comprises means for authenticating th

Assignees

• Qualcomm Inc

Inventors

• Manohar Bollapragada V J
• Muthukumaran Baranidharan

Classifications

• H04W12/06

  Authentication · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04L12/06

  Answer-back mechanisms or circuits · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title