# US 10,313,335 B2 · Server and/or client device authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,335 B2 - Document ID: US10313335B2 - Status: Granted - Kind: B2 - Application number: 15/858,227 - Filed: 2017-12-29 - Published: 2018-05-24 - Granted: 2019-06-04 - Earliest claimed: 2007-12-28 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Upendra Mardikar; Kent Griffin; Allison Elizabeth Miller; Amol Patel - Web page: https://patentgrep.com/patent/US10313335B2 ## CPC - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0838: {using one-time-passwords} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04W 12/06: Authentication - H04W 12/12: Detection or prevention of fraud - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 2209/80: Wireless - H04W 12/72: Subscriber identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments of systems and methods for client and/or server authentication are provided. In one embodiment, a method includes sending information from a mobile network device to a server, wherein the information comprises a seed that is used by both the mobile network device and the server to compute a series of one time passwords. The method also includes receiving, by the mobile network device, a succession of one time passwords generated by the server throughout a session. And the method further includes comparing the received one time passwords generated by the server throughout the session to corresponding one time passwords generated at the mobile network device. In this manner, the server can be authenticated. In various embodiments, the process may be reversed to facilitate client, e.g., mobile network device, authentication. ## Claims ### Claim 1 A mobile network device comprising: a non-transitory memory storing passcode computation software; and one or more hardware processors coupled to the non-transitory memory and configured to read the passcode computation software from the memory to cause the mobile network device to perform operations comprising: generating, from a token, a first mobile network device passcode at a first time period during a computing session with a computing device; receiving, from the computing device, a corresponding first computing device passcode for the first time period; and extending the computing session in response to the corresponding first computing device passcode matching the first mobile network device passcode at the first time period. ### Claim 2 (depends on 1) The mobile network device of claim 1, the operations further comprising: generating, from the token, a second mobile network device passcode at a second time period during the computing session, wherein the second mobile network device passcode is different from the first mobile network device passcode; receiving, from the computing device, a corresponding second computing device passcode for the second time period; and extending the computing session in response to the corresponding second computing device passcode matching the second mobile network device passcode at the second time period. ### Claim 3 (depends on 1) The mobile network device of claim 1, the operations further comprising: halting the computing session in response to the corresponding first computing device passcode not matching the first mobile network device passcode at the first time period. ### Claim 4 (depends on 1) The mobile network device of claim 1, the operations further comprising: receiving, prior to generating the first mobile network device passcode, a cookie from the computing device. ### Claim 5 (depends on 4) The mobile network device of claim 4, wherein the token comprises the cookie. ### Claim 6 (depends on 4) The mobile network device of claim 4, the operations further comprising: generating the token from the cookie and information unique to the mobile network device. ### Claim 7 (depends on 1) The mobile network device of claim 1, the operations further comprising: repeating the generating, receiving, and extending in response to matching according to a time period between one second and sixty seconds. ### Claim 8 A method comprising: establishing, by a processor of a mobile computing device, a computing session having a first time period with a computing device; receiving, by the mobile computing device from the computing device, a first computing device passcode at a first time during the first time period; matching, by the mobile computing device, the received first computing device passcode to a second computing device passcode generated from a token; and extending the computing session to a second time period beyond the first time period in response to the matching. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving, by the mobile computing device from the computing device, a third computing device passcode during the second time period; matching the received third computing device password to a fourth computing device password generated from the token; and extending the computing session beyond the second time period in response to matching the received third computing device password to the fourth computing device password. ### Claim 10 (depends on 8) The method of claim 8, further comprising: halting the computing session in response to the received first computing device passcode not matching the second computing device passcode during the first time period. ### Claim 11 (depends on 8) The method of claim 8, further comprising: receiving, electronically by the mobile computing device, a cookie from the computing device. ### Claim 12 (depends on 11) The method of claim 11, wherein the token comprises the cookie. ### Claim 13 (depends on 11) The method of claim 11, wherein the token is generated from the cookie and information unique to the mobile computing device. ### Claim 14 (depends on 8) The method of claim 8, wherein the first time period is between one second and sixty seconds. ### Claim 15 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: generating, from a token, a first mobile network device passcode during a first time period of a computing session with a computing device; receiving, from the computing device, a corresponding first computing device passcode before the computing session ends; and extending the computing session beyond the first time period in response to the corresponding first computing device passcode matching the first mobile network device passcode. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: generating, from the token, a second mobile network device passcode during a second time period of the extended computing session, wherein the second mobile network device passcode is different from the first mobile network device passcode; receiving, from the computing device, a corresponding second computing device passcode before the extended computing session ends; and extending the extended computing session beyond the second time period in response to the corresponding second computing device passcode matching the second mobile network device passcode. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: halting the computing session after the first time period in response to the corresponding first computing device passcode not matching the first mobile network device passcode. ### Claim 18 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: receiving, prior to generating the first mobile network device passcode, a cookie from the computing device. ### Claim 19 (depends on 18) The non-transitory machine-readable medium of claim 18, wherein the operations further comprise: using the cookie as the token. ### Claim 20 (depends on 18) The non-transitory machine-readable medium of claim 18, wherein the operations further comprise: generating the token from the cookie and information unique to the machine.