Systems and methods for validating login attempts based on user location

Patent metadata

Field	Value
Publication number	US-9529990-B2
Application number	US-201514735195-A
Country	US
Kind code	B2
Filing date	Jun 10, 2015
Priority date	Mar 5, 2014
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

A computer-implemented method for validating login attempts based on user location may include (1) detecting a login attempt by a user to log into a user account, where the login attempt originates from an atypical location, (2) determining that the atypical location is inconsistent with a pattern of past login locations for the user, (3) retrieving location information that indicates a current location of the user from at least one third-party Internet resource, (4) determining, based on the location information, that the atypical location of the login attempt matches the current location of the user, and (5) trusting that the login attempt legitimately originates from the user based at least in part on the atypical location matching the current location of the user. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for validating login attempts based on user location, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
detecting a login attempt by a user to log into a user account, wherein the login attempt originates from an atypical location;
detecting the atypical location of the login attempt;
determining that the atypical location is inconsistent with a pattern of past login locations for the user;
retrieving location information that indicates a current location of the user from at least one third-party Internet resource by:
authenticating to a shared authentication system that grants access to a plurality of Internet resources;
authenticating to the third-party Internet resource via the shared authentication system;

determining, based on the location information, that the atypical location of the login attempt matches the current location of the user;
trusting that the login attempt legitimately originates from the user based at least in part on the atypical location matching the current location of the user.

2. The computer-implemented method of claim 1 , wherein the location information that indicates the current location of the user comprises a destination of a plane ticket purchased by the user.

3. The computer-implemented method of claim 1 , wherein the location information that indicates the current location of the user comprises a location specified by an event ticket purchased by the user.

4. The computer-implemented method of claim 1 , wherein the location information that indicates the current location of the user comprises a picture uploaded by the user that comprises location metadata.

5. The computer-implemented method of claim 1 , wherein the location information that indicates the current location of the user comprises a picture including the user that comprises location metadata.

6. The computer-implemented method of claim 1 , wherein the location information that indicates the current location of the user comprises a location of a purchase made by the user.

7. The computer-implemented method of claim 1 , wherein the third-party Internet resource comprises a retail website.

8. The computer-implemented method of claim 1 , wherein the location information that indicates the current location of the user comprises at least one of:
a location specified in a calendar event that the user is scheduled to attend;
a location of a check-in performed by the user;
geolocation data reported by a device owned by the user;
an Internet protocol address of the user.

9. The computer-implemented method of claim 1 , wherein the third-party Internet resource comprises at least one of:
a social networking platform;
a calendaring service.

10. The computer-implemented method of claim 1 , further comprising:
identifying a security measure that applies to login attempts from atypical locations;
disabling the security measure for the login attempt in response to trusting that the login attempt legitimately originates from the user.

11. The computer-implemented method of claim 1 , further comprising:
identifying a trustworthy location database for the user that stores at least one legitimate location from the pattern of past login locations for the user;
storing the atypical location in the trustworthy location database based on trusting that the login attempt legitimately originates from the user;
trusting a future login attempt at the atypical location based on the atypical location being stored in the trustworthy location database.

12. The computer-implemented method of claim 1 , wherein retrieving the location information that indicates the current location of the user from the third-party Internet resource comprises:
identifying a database of pointers to third-party Internet resources that comprise user location information;
retrieving a pointer to the third-party Internet resource from the database;
following the pointer to the third-party Internet resource.

13. The computer-implemented method of claim 1 , wherein determining that the atypical location is inconsistent with the pattern of past login locations for the user comprises determining that the atypical login location comprises a location that exceeds a predetermined threshold for closeness to a known legitimate location of the user.

14. The computer-implemented method of claim 1 , wherein the determining that the atypical location is inconsistent with the pattern of past login locations for the user comprises determining that the atypical login location comprises a location that has not met a predetermined threshold for legitimate logins by the user at the location.

15. The computer-implemented method of claim 1 , wherein:
the third-party Internet resource comprises a retail website;
the location information that indicates the current location of the user comprises a location specified by a ticket purchased by the user from the retail website.

16. The computer-implemented method of claim 1 , wherein determining that the atypical location is inconsistent with the pattern of past login locations for the user comprises determining that the login attempt is suspicious based on the login attempt originating from a different location than any of the past login locations.

17. The computer-implemented method of claim 1 , wherein determining that the atypical location of the login attempt matches the current location of the user comprises attempting to verify that the atypical location is the current location of the user in response to determining that the atypical location is inconsistent with the pattern of past login locations for the user.

18. A system for validating login attempts based on user location, the system comprising:
a detection module, stored in memory, that:
detects a login attempt by a user to log into a user account, wherein the login attempt originates from an atypical location;
detects the atypical location of the login attempt;

a determination module, stored in memory, that determines that the atypical location is inconsistent with a pattern of past login locations for the user;
a retrieval module, stored in memory, that retrieves location information that indicates a current location of the user from at least one third-party Internet resource by:
authenticating to a shared authentication system that grants access to a plurality of Internet resources;
authenticating to the third-party Internet resource via the shared authentication system;

a matching module, stored in memory, that determines, based on the location information, that the atypical location of the login attempt matches the current location of the user;
a trust module, stored in memory, that trusts that the login attempt legitimately originates from the user based at least in part on the atypical location matching the current location of the user;
at least one physical processor configured to execute the detection module, the determination module, the retrieval module, the matching module, and the trust module.

19. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
detect a login attempt by a user to log into a user account, wherein the login attempt originates from an atypical location;
detect the atypical location of the login attempt;
determine that the atypical location is inconsistent wi

Assignees

• Symantec Corp

Inventors

• Newstadt Keith
• Sokolov Ilya

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04W12/08

  Access security · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title