# US 10,320,848 B2 · Smart lockout > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,848 B2 - Document ID: US10320848B2 - Status: Granted - Kind: B2 - Application number: 15/223,040 - Filed: 2016-07-29 - Published: 2017-07-20 - Granted: 2019-06-11 - Earliest claimed: 2016-01-15 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC. - Inventors: Alexandre Kerametlian; Amit Dhariwal; Dana Kaufman; Winfred Wong - Web page: https://patentgrep.com/patent/US10320848B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 21/31: User authentication - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments are directed to having multiple lockout counters that apply to login requests from different origins. More specifically, one counter is associated with a user's familiar locations, another counter is associated with unfamiliar locations. In another embodiment, hashes of incorrect passwords are recorded so that lockout counters are not incremented multiple times when the same incorrect password is entered repeatedly. ## Claims ### Claim 1 A computer-implemented method for controlling access to a computing account by preventing potentially malicious authentication requests originating from unrecognized sources from interfering with a determined normal usage of the computing account, the access being controlled through use of multiple distinct counters that are used to monitor different types of access attempts, the method being performed by one or more processors of a computer system and comprising: at the computer system, receiving an authentication request requesting access to the computing account, the authentication request being received from a user device that is requesting the access to the computing account; at the computer system, determining that the authentication request includes an incorrect credential, the incorrect credential being a credential that is presently unusable to gain access to the computing account; at the computer system, identifying a device trait associated with the user device that transmitted the authentication request, the device trait being used by the computer system to determine whether the user device is familiar or unfamiliar, wherein the computer system determines that the user device is familiar when the computer system identifies a particular relationship existing between the user device's device trait and the computing account, and wherein the computer system determines that the user device is unfamiliar when the computer system is unable to identify the particular relationship; at the computer system, incrementing a first counter when the computer system determines that the user device is familiar and when the incorrect credential is received, the first counter being associated with the determined normal usage of the computing account and being used to identify when familiar user devices are submitting incorrect credentials; at the computer system, incrementing a second counter when the computer system determines that the user device is unfamiliar and when the incorrect credential is received, wherein the second counter is not associated with the determined normal usage of the computing account and instead is used to identify when potentially malicious authentication requests are being submitted; and at the computer system, selectively modifying access to the computing account based on the second counter. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: if the user device is familiar, comparing a first counter value of the first counter to a first threshold; and locking out additional access attempts associated with the familiar user device if the first counter value has exceeded the first threshold, wherein additional access attempts associated with an unfamiliar user device are allowed unless a second counter value of the second counter has exceeded a second threshold. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: if the user device is unfamiliar, comparing a second counter value of the second counter to a second threshold; and locking out additional access attempts associated with the unfamiliar user device if the second counter value has exceeded the second threshold, wherein additional access attempts associated with a familiar user device are allowed unless a first counter value of the first counter has exceeded a first threshold. ### Claim 4 (depends on 2) The computer-implemented method of claim 2, further comprising: resetting the first counter value after a cooldown time has expired. ### Claim 5 (depends on 3) The computer-implemented method of claim 3, further comprising: resetting the second counter value after a cooldown time has expired. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the device trait is a current location associated with the user device, and wherein the user device is determined to be familiar if a prior successful authentication request originated from the current location of the user device such that the particular relationship is determined to include a condition in which the prior successful authentication request originated from the current location. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: at the computer system, storing a list of complete or partial hashes of a selected number of prior incorrect credentials in a storage while refraining from storing the actual prior incorrect credentials in the storage; and checking a determined hash of the incorrect credential against the complete or partial hashes in the list to determine whether the determined hash is included in the list. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: comparing the incorrect credential received in the authentication request to a list of prior incorrect credentials stored in a storage; and preventing the first or second counter from being incremented when the incorrect credential matches at least one of the prior incorrect credentials stored in the storage. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the incorrect credential is selected from the group consisting of: an application password, an authenticator-generated code, a code sent via email, text, message or mobile device, a secret answer, a one-time use code, a one-time token (OTT), and a personal identification number (PIN). ### Claim 10 A system comprising: one or more processors; and one or more computer-readable hardware storage devices having stored thereon computer-executable instructions that are executable by the one or more processors to cause the system to control access to a computing account by preventing potentially malicious authentication requests originating from unrecognized sources from interfering with a determined normal usage of the computing account, the computing account being controlled through use of multiple distinct counters that are used to monitor different types of access attempts, the computer-executable instructions thereby causing the computer system to: at the computer system, receive an authentication request requesting access to the computing account, the authentication request being received from a user device that is requesting the access to the computing account; at the computer system, determine that the authentication request includes an incorrect credential, the incorrect credential being a credential that is presently unusable to gain access to the computing account; at the computer system, identify a device trait associated with the user device that transmitted the authentication request, the device trait being used by the computer system to determine whether the user device is familiar or unfamiliar, wherein the computer system determines that the user device is familiar when the computer system identifies a particular relationship existing between the user device's device trait and the computing account, and wherein the computer system determines that the user device is unfamiliar when the computer system is unable to identify the particular relationship; at the computer system, increment a first counter when the computer system determines that the user device is familiar and when the incorrect credential is received, the first counter being associated with the determined normal usage of the computing account and being used to identify when familiar user devices are submitting incorrect credentials; at the computer system, increment a second counter when the computer system determines that the user device is unfamiliar and when the incorrect credential is received, wherein the second counter is not associated with the determined normal usage of the computing account and instead is used to identify when potentially malicious authentication requests are being submitted; and at the computer system, selectively modify access to the computing account based on the second counter. ### Claim 11 (depends on 10) The system of claim 10, wherein execution of the computer-executable instructions further causes the system to: if the user device is familiar, compare a first counter value of the first counter to a first threshold; and lock out additional access attempts associated with the familiar user device if the first counter value has exceeded the first threshold, wherein additional access attempts associated with an unfamiliar user device are allowed unless a second counter value of the second counter has exceeded a second threshold. ### Claim 12 (depends on 10) The system of claim 10, wherein execution of the computer-executable instructions further causes the system to: if the user device is unfamiliar, compare a second counter value of the second counter to a second threshold; and lock out additional access attempts associated with the unfamiliar user device if the second counter value has exceeded the second threshold, wherein additional access attempts associated with a familiar user device are allowed unless a first counter value of the first counter has exceeded a first threshold. ### Claim 13 (depends on 11) The system of claim 11, wherein the first counter value is reset after a cooldown time has expired. ### Claim 14 (depends on 12) The system of claim 12, wherein the second counter value is reset after a cooldown time has expired. ### Claim 15 (depends on 10) The system of claim 10, wherein the device trait is a current location associated with the user device, and wherein the user device is determined to be familiar if a prior successful authentication request originated from the current location of the user device. ### Claim 16 (depends on 10) The system of claim 10, further comprising: a storage device configured to store complete or partial hashes of prior incorrect credentials. ### Claim 17 (depends on 16) The system of claim 16, wherein execution of the computer-executable instructions further causes the system to: compare the incorrect credential received in the authentication request to a list of prior incorrect credentials stored in a storage; and prevent the first or second counter from being incremented when the incorrect credential matches at least one of the prior incorrect credentials stored in the storage. ### Claim 18 (depends on 10) The system of claim 10, wherein the incorrect credential is selected from the group consisting of: an application password, an authenticator-generated code, a code sent via email, text, message or mobile device, a secret answer, a one-time use code, a one-time token (OTT), and a personal identification number (PIN). ### Claim 19 One or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system to cause the computer system to control access to a computing account by preventing potentially malicious authentication requests originating from unrecognized sources from interfering with a determined normal usage of the computing account, the computing account being controlled through use of multiple distinct counters that are used to monitor different types of access attempts, the computer-executable instructions thereby causing the computer system to: at the computer system, receive an authentication request requesting access to the computing account, the authentication request being received from a user device that is requesting the access to the computing account; at the computer system, determine that the authentication request includes an incorrect credential, the incorrect credential being a credential that is presently unusable to gain access to the computing account; at the computer system, identify a device trait associated with the user device that transmitted the authentication request, the device trait being used by the computer system to determine whether the user device is familiar or unfamiliar, wherein the computer system determines that the user device is familiar when the computer system identifies a particular relationship existing between the user device's device trait and the computing account, and wherein the computer system determines that the user device is unfamiliar when the computer system is unable to identify the particular relationship; at the computer system, increment a first counter when the computer system determines that the user device is familiar and when the incorrect credential is received, the first counter being associated with the determined normal usage of the computing account and being used to identify when familiar user devices are submitting incorrect credentials; at the computer system, increment a second counter when the computer system determines that the user device is unfamiliar and when the incorrect credential is received, wherein the second counter is not associated with the determined normal usage of the computing account and instead is used to identify when potentially malicious authentication requests are being submitted; and at the computer system, selectively modify access to the computing account based on the second counter. ### Claim 20 (depends on 19) The one or more hardware storage devices of claim 19, wherein execution of the computer-executable instructions further causes the computer system to: if the user device is familiar: compare a first counter value of the first counter to a first threshold; and lock out additional access attempts associated with the familiar user device if the first counter value has exceeded the first threshold, wherein additional access attempts associated with an unfamiliar user device are allowed unless a second counter value of the second counter has exceeded a second threshold; and if the user device is unfamiliar: compare the second counter value to the second threshold; and lock out additional access attempts associated with the unfamiliar user device if the second counter value has exceeded the second threshold, wherein additional access attempts associated with the familiar user device are allowed unless the first counter value has exceeded the first threshold.