# US 10,122,715 B2 · Enhanced multi factor authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,715 B2 - Document ID: US10122715B2 - Status: Granted - Kind: B2 - Application number: 15/362,719 - Filed: 2016-11-28 - Published: 2017-03-16 - Granted: 2018-11-06 - Earliest claimed: 2006-11-16 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Stephen T. Dispensa - Web page: https://patentgrep.com/patent/US10122715B2 ## CPC - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/166: {at the transport layer} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a network element comprises one or more processors, and a memory module communicatively coupled to the processor. The memory module comprises logic instructions which, when executed by the processor, configure the processor to receive, via a first communication channel, a primary authentication request transmitted from a user from a first device, process the primary authentication request to determine whether the user is authorized to access one or more resources, in response to a determination that the user is authorized to access one or more resources, initiate, a secondary authentication request, and transmit the secondary authentication request from the network element to the user via a second communication channel, different from the first communication channel. ## Claims ### Claim 1 An authentication computer system comprising: one or more processors; and one or more computer-readable hardware storage devices having stored thereon computer-executable instructions that are executable by the one or more processors and that cause the authentication computer system to authenticate a resource access request by causing the authentication computer system to: receive, from a first client device associated with a user, a request to access one or more resources, wherein the request is received at the authentication computer system via a first communication channel, the request including a username and password; search a credential data file to determine whether the received username and password are authorized credentials, wherein the username is associated with multiple different passwords in the data file, and wherein each of the multiple different passwords is associated with a different resource; determine that the received username and password correspond to the requested one or more resources such that the received username and password are authorized credentials for the requested one or more resources; issue a system-initiated authentication request from the authentication computer system, wherein the system-initiated authentication request is transmitted to a second client device of the user via a second communication channel, and wherein the system-initiated authentication request includes a customized communication; receive, from the second client device via the second communication channel, a response to the system-initiated authentication request, the response corresponding to the customized communication, wherein the response includes a set of user-provided authentication information, the set of user-provided authentication information including an oral message that was recorded personally by the user and that is associated with the customized communication; based at least on a determination that the set of user-provided authentication information is valid, grant the first client device access to the one or more resources; and based at least on a detection of a failure relating to (1) the request to access the one or more resources or (2) the response to the system-initiated authentication request, deny access to the one or more resources and transmit an error message to both the first client device via the first communication channel and the second client device via the second communication channel. ### Claim 2 (depends on 1) The authentication computer system of claim 1, wherein the determination that the set of user-provided authentication information is valid comprises comparing the oral message that was recorded personally by the user with a previously recorded oral message that was also recorded by the user. ### Claim 3 (depends on 1) The authentication computer system of claim 1, wherein the determination that the set of user-provided authentication information is valid comprises analyzing the oral message to determine whether the user spoke a certain set of required words. ### Claim 4 (depends on 1) The authentication computer system of claim 1, wherein the response to the system-initiated authentication request includes a sequence of keystrokes entered by the user, and wherein determining that the set of user-provided authentication information is valid comprises analyzing the sequence of keystrokes to determine whether the sequence of keystrokes is valid. ### Claim 5 (depends on 1) The authentication computer system of claim 1, wherein the first client device and the second client device are a same network device, and wherein the same network device is logically separable such that the same network device includes functionality corresponding to the first client device and includes functionality corresponding to the second client device. ### Claim 6 (depends on 1) The authentication computer system of claim 1, wherein the set of user-provided authentication information is stored in a memory cache for a predetermined period of time. ### Claim 7 (depends on 6) The authentication computer system of claim 6, wherein execution of the computer-executable instructions further causes the authentication computer system to: detect that the user is attempting to access the one or more resources for a second time; detect that the predetermined period of time has not yet elapsed; and grant the user access to the one or more resources without requiring the user to present additional authentication information. ### Claim 8 (depends on 6) The authentication computer system of claim 6, wherein execution of the computer-executable instructions further causes the authentication computer system to: when the request to access the one or more resources was received, detect a network address of the first client device; detect that the user is attempting to access the one or more resources for a second time, the second time being later than when the request to access the one or more resources was received; detect that the predetermined period of time has not yet elapsed; detect a current network address that the user is currently using; and upon a condition in which the current network address and the network address detected when the request to access the one or more resources was received are a same address, grant the user access to the one or more resources without requiring the user to present additional authentication information. ### Claim 9 (depends on 1) The authentication computer system of claim 1, wherein execution of the computer-executable instructions further causes the authentication computer system to: record a number of times the user attempts to access the one or more resources yet provides invalid authentication information; and upon a condition in which the number of times reaches a predetermined number of times, perform corrective action. ### Claim 10 (depends on 9) The authentication computer system of claim 9, wherein the corrective action is flagging the user as a suspect for fraudulent access. ### Claim 11 A method, implemented at a computer system that includes one or more processors, for authenticating a resource access request, the method comprising: receiving, from a first client device associated with a user, a request to access one or more resources, wherein the request is received at the computer system via a first communication channel, the request including a username and password; searching a credential data file to determine whether the received username and password are authorized credentials, wherein the username is associated with multiple different passwords in the data file, and wherein each of the multiple different passwords is associated with a different resource; issuing a system-initiated authentication request from the computer system, wherein the system-initiated authentication request is transmitted to a second client device of the user via a second communication channel, and wherein the system-initiated authentication request includes a customized communication; receiving, from the second client device via the second communication channel, a response to the system-initiated authentication request, the response corresponding to the customized communication, wherein the response includes a set of user-provided authentication information, the set of user-provided authentication information including an oral message that was recorded personally by the user and that is associated with the customized communication; based at least on a determination that the set of user-provided authentication information is valid, granting the first client device access to the one or more resources; and based at least on a detection of a failure relating to (1) the request to access the one or more resources or (2) the response to the system-initiated authentication request, denying access to the one or more resources and transmit an error message to both the first client device via the first communication channel and the second client device via the second communication channel. ### Claim 12 (depends on 11) The method of claim 11, wherein determining that the set of user-provided authentication information is valid comprises comparing the oral message that was recorded personally by the user with a previously recorded oral message that was also recorded by the user. ### Claim 13 (depends on 11) The method of claim 11, wherein determining that the set of user-provided authentication information is valid comprises analyzing the oral message to determine whether the user spoke a certain set of required words. ### Claim 14 (depends on 11) The method of claim 11, wherein the response to the system-initiated authentication request includes a sequence of keystrokes entered by the user, and wherein determining that the set of user-provided authentication information is valid comprises analyzing the sequence of keystrokes to determine whether the sequence of keystrokes is valid. ### Claim 15 (depends on 11) The method of claim 11, wherein the first client device and the second client device are a same network device, and wherein the same network device is logically separable such that the same network device includes functionality corresponding to the first client device and includes functionality corresponding to the second client device. ### Claim 16 One or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system and that cause the computer system to authenticate a resource access request by causing the computer system to: receive, from a first client device associated with a user, a request to access one or more resources, wherein the request is received at the computer system via a first communication channel, the request including a username and password; search a credential data file to determine whether the received username and password are authorized credentials, wherein the username is associated with multiple different passwords in the data file, and wherein each of the multiple different passwords is associated with a different resource; determine that the received username and password correspond to the requested one or more resources such that the received username and password are authorized credentials for the requested one or more resources; issue a system-initiated authentication request from the computer system, wherein the system-initiated authentication request is transmitted to a second client device of the user via a second communication channel, and wherein the system-initiated authentication request includes a customized communication; receive, from the second client device via the second communication channel, a response to the system-initiated authentication request, the response corresponding to the customized communication, wherein the response includes a set of user-provided authentication information, the set of user-provided authentication information including an oral message that was recorded personally by the user and that is associated with the customized communication; based at least on a determination that the set of user-provided authentication information is valid, grant the first client device access to the one or more resources; and based at least on a detection of a failure relating to (1) the request to access the one or more resources or (2) the response to the system-initiated authentication request, deny access to the one or more resources and transmit an error message to both the first client device via the first communication channel and the second client device via the second communication channel. ### Claim 17 (depends on 16) The one or more hardware storage devices of claim 16, wherein the set of user-provided authentication information is stored in a memory cache for a predetermined period of time. ### Claim 18 (depends on 17) The one or more hardware storage devices of claim 17, wherein execution of the computer-executable instructions further causes the computer system to: detect that the user is attempting to access the one or more resources for a second time; detect that the predetermined period of time has not yet elapsed; and grant the user access to the one or more resources without requiring the user to present additional authentication information. ### Claim 19 (depends on 17) The one or more hardware storage devices of claim 17, wherein execution of the computer-executable instructions further causes the computer system to: when the request to access the one or more resources was received, detect a network address of the client device; detect that the user is attempting to access the one or more resources for a second time, the second time being later than when the request to access the one or more resources was received; detect that the predetermined period of time has not yet elapsed; detect a current network address that the user is currently using; and upon a condition in which the current network address and the network address detected when the request to access the one or more resources was received are a same address, grant the user access to the one or more resources without requiring the user to present additional authentication information. ### Claim 20 (depends on 16) The one or more hardware storage devices of claim 16, wherein execution of the computer-executable instructions further causes the computer system to: record a number of times the user attempts to access the one or more resources yet provides invalid authentication information; and upon a condition in which the number of times reaches a predetermined number of times, perform corrective action.