Proximity-based user authentication for providing a webpage of an access-controlled application

Patent metadata

Field	Value
Publication number	US-2020210604-A1
Application number	US-202016815057-A
Country	US
Kind code	A1
Filing date	Mar 11, 2020
Priority date	Apr 30, 2018
Publication date	Jul 2, 2020
Grant date	—

Abstract

Example embodiments relate to controlling secured access to electronically provided application functionality or content. An Internet browser executing on a first computing device initiates periodic polling of a paired second computing device associated with a user for measurements of short range communication protocol signal strength of the second computing device and determines that the second computing device is within an authentication distance of the first computing device. The secure Internet browser transmits an authentication request comprising a device identifier of the second computing device. Responsive to transmitting the authentication request, the secure Internet browser receives an authentication response indicating authentication confirmation, and responsive thereto, the secure Internet browser provides access to a controlled-access application by transmitting a request to a content server for a presentation of the controlled-access application, receiving from the content server a presentation associated with the user, and directing display of the presentation via a user interface.

First claim

1 . A method for providing access to a controlled-access application accessible by a secure Internet browser, the method comprising:
responsive to determining that a second computing device is within an authentication distance of a first computing device based at least in part on a short range communication (SRC) protocol signal strength of the second computing device, transmitting, by the secure Internet browser executing on the first computing device, an authentication request to a first server, wherein the authentication request comprises (a) a device identifier of the second computing device, and (b) a user credential of a user associated with the second computing device; responsive to transmitting the authentication request, receiving, by the secure Internet browser originating from the first server, an authentication response, wherein the authentication response (a) indicates that the second computing device has been authenticated, (b) indicates that a secure session has been initiated for the user, and (c) comprises a session identifier; and responsive to receiving the authentication response, providing, by the secure Internet browser, access to the controlled-access application by:
transmitting, by the secure Internet browser to a second server, a request for a presentation associated with the controlled-access application, wherein the request for the presentation comprises the session identifier,
receiving, by the secure Internet browser originating from the second server, the presentation, and
directing display of, by the secure Internet browser, the presentation.

2 . The method of claim 1 further comprising:
determining, by the secure Internet browser, that the second computing device is outside a lock distance from the first computing device, wherein the lock distance is the same as or greater than the authentication distance; and
responsive to determining that the second computing device is outside the lock distance from the first computing device, locking the secure Internet browser.

3 . The method of claim 2 , wherein the second computing device is determined to be outside the lock distance from the first computing device when a predetermined number of received measurements of SRC protocol signal strength of the second computing device is less than or equal to a predetermined threshold.

4 . The method of claim 1 further comprising receiving, by the secure Internet browser from the second computing device, a passkey associated with the user, wherein (a) the user credential comprises the passkey, and (b) the passkey comprises at least one of a personal identification number (PIN), biometric data, gesture data, or a soft token.

5 . The method of claim 1 , further comprising receiving, by the secure Internet browser from the second computing device, the device identifier of the second computing device.

6 . The method of claim 1 , wherein (a) the SRC protocol comprises at least one of Bluetooth, low energy Bluetooth, Near-Field Communication (NFC), Wi-Fi, ZigBee, Z-Wave, 6LoWPAN, infrared frequency protocol, or radio frequency identification (RFID), and (b) the first server and the second server are the same server.

7 . The method of claim 1 , wherein the first computing device comprises at least one of a kiosk, an automated teller machine (ATM), a tablet, a laptop, a desktop, and a mobile device.

8 . The method of claim 1 , wherein the presentation is personalized based at least in part on a personalized configuration setting associated with the user.

9 . A first computing device for providing a controlled-access application accessible by a secure Internet browser executing on the first computing device, the first computing device comprising at least one processor and at least one memory storing computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the first computing device to at least:
responsive to determining that a second computing device is within an authentication distance of a first computing device based at least in part on a short range communication (SRC) protocol signal strength of the second computing device, transmit, by the secure Internet browser executing on the first computing device, an authentication request to a first server, wherein the authentication request comprises (a) a device identifier of the second computing device, and (b) a user credential of a user associated with the second computing device; responsive to transmitting the authentication request, receive, by the secure Internet browser originating from the first server, an authentication response, wherein the authentication response (a) indicates that the second computing device has been authenticated, (b) indicates that a secure session has been initiated for the user, and (c) comprises a session identifier; and responsive to receiving the authentication response, provide, by the secure Internet browser, access to the controlled-access application by:
transmitting, by the secure Internet browser to a second server, a request for a presentation associated with the controlled-access application, wherein the request for the presentation comprises the session identifier,
receiving, by the secure Internet browser originating from the second server, the presentation, and
directing display of, by the secure Internet browser, the presentation.

10 . The first computing device of claim 9 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the first computing device to at least:
determine, by the secure Internet browser, that the second computing device is outside a lock distance from the first computing device, wherein the lock distance is the same as or greater than the authentication distance; and responsive to determining that the second computing device is outside the lock distance from the first computing device, lock the secure Internet browser or terminate the session.

11 . The first computing device of claim 10 , wherein the second computing device is determined to be outside the lock distance from the first computing device when a predetermined number of received measurements of SRC protocol signal strength of the second computing device is less than or equal to a predetermined threshold.

12 . The first computing device of claim 9 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the first computing device to at least receive, by the secure Internet browser from the second computing device, an authentication token associated with the user, wherein the authentication request comprises the authentication token.

13 . The first computing device of claim 9 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the first computing device to at least receive, by the secure Internet browser from the second computing device, a passkey associated with the user, wherein (a) the user credential comprises the passkey, and (b) the passkey comprises at least one of a personal identification number (PIN), biometric data, gesture data, or a soft token.

14 . The first computing device of claim 9 , wherein (a) the SRC protocol comprises at least one of Bluetooth, low energy Bluetooth, Near-Field Communication (NFC), Wi-Fi, ZigBee, Z-Wave, 6LoWPAN, infrared frequency protocol, or radio frequency identification (RFID), and (b) the first server and the second server are the same server.

15 . The first computing device o

Assignees

• Fiserv Inc

Inventors

• Graf Scott
• Landry Christopher David
• Wang Dennis Yihhaw

Classifications

• H04W12/64

  using geofenced areas · CPC title

• H04W12/30

  Security of mobile devices; Security of mobile applications · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04W4/80

  Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication · CPC title

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title