# US 10,375,082 B2 · Method and apparatus for geographic location based electronic security management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,082 B2 - Document ID: US10375082B2 - Status: Granted - Kind: B2 - Application number: 15/243,786 - Filed: 2016-08-22 - Published: 2017-07-06 - Granted: 2019-08-06 - Earliest claimed: 2015-08-20 - Assignees: Averon US, Inc. - Applicants: Averon US, Inc. - Inventors: Wendell Brown; Edward Mehr - Web page: https://patentgrep.com/patent/US10375082B2 ## CPC - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - H04L 63/0492: {by using a location-limited connection, e.g. near-field communication or limited proximity of entities} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Provided herein are embodiments directed to facilitating an authentication process before allowing an action. An example apparatus may be configured to receive a request, via an authentication session established during a log-in process, to cause the action, send alert to a first device associated with an account associated with the requested action, cause the first device to communicate, via the short range wireless communication protocol, with a second device to verify a proximity, receive verification of the proximity, receive a first identifying data originating in a browser having been used to start the authentication session, receive a second identifying data string originating from a trusted agent, configured as software or hardware, residing on the second device, and upon confirmation of a match of the first identifying data string and the second identifying data string, authorize the action. ## Claims ### Claim 1 A computer implemented authentication method for verifying, validating or otherwise confirming a location of a first device, using a second device before enabling or allowing an action, the method comprising: receiving a request, via an authentication session established during a log-in process, to cause the action from the second device; in response to receiving the request, sending an alert to the first device associated with an account associated with the requested action enabling receiving or transmitting of short range wireless communication protocol; causing the first device to communicate, via the short range wireless communication protocol, with the second device to verify a proximity of the first device and the second device; receiving verification of the proximity from the first device; causing a trusted agent residing on the second device to send identification information to the first device, the identification information being information that uniquely identifies the trusted agent; receiving, from the second device, a first identifying data string, the first identifying data string originating in a browser, operating on the second device, having been used to start the authentication session; receiving, from the first device, a second identifying data string, the second identifying data string originating from the trusted agent, configured as software or hardware, residing on the second device; and upon confirmation of a match of the first identifying data string and the second identifying data string, authorizing the action. ### Claim 2 (depends on 1) The computer implemented authentication method of claim 1, further comprising: receiving data indicative of a biometric input at the first device; and preceding authorization of the action, confirming a match of the data indicative of the biometric input to stored biometric data associated with a user of the first device. ### Claim 3 (depends on 1) The computer implemented authentication method according to claim 1, wherein the causing the first device to communicate with the second device to verify the proximity of the first device and the second device, further comprising: receiving an indication of a location of the first device by means of GPS, Wi-Fi, or mobile network location information; comparing the location of the first device to a location of the second device, the second device having a verifiable or confirmed location and being independent to the first device; verifying the proximity of the first device to the second device, confirming the location of the first device based on the verifiable or confirmed location of the second device. ### Claim 4 (depends on 1) The computer implemented authentication method according to claim 1, further comprising: upon determination of the location of the first device and preceding authorization of the action, determining the location is within a predefined authorized geo-region. ### Claim 5 (depends on 1) The computer implemented authentication method according to claim 1, further comprising: upon determination of the location of the first device and preceding authorization of the action, determining the location is within a predefined range of a pre-defined authorized location. ### Claim 6 (depends on 1) The computer implemented authentication method according to claim 1, further comprising: upon determination of the location of the first device and preceding authorization of the action, determining the location is not within a predefined un-authorized geo-region. ### Claim 7 (depends on 1) The computer implemented authentication method according to claim 1, further comprising: upon determination of the location of the first device by means of GPS, Wi-Fi, or mobile network location information and preceding authorization of the action, receive input at a third device; and upon verification of input at the third device, authorizing the action. ### Claim 8 An authentication apparatus configured for verifying, validating or otherwise confirming a location of a first device, using a second device before enabling or allowing an action, the authentication apparatus comprising at least one processor and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the processor, cause the authentication apparatus to at least: receive a request, via an authentication session established during a log-in process, to cause the action from the second device; in response to receiving the request, send an alert to the first device associated with an account associated with the requested action enabling receiving or transmitting of short range wireless communication protocol; cause the first device to communicate, via the short range wireless communication protocol, with the second device to verify a proximity of the first device and the second device; receive verification of the proximity from the first device; cause a trusted agent residing on the second device to send identification information to the first device, the identification information being information that uniquely identifies the trusted agent; receive, from the second device, a first identifying data string, the first identifying data string originating in a browser, operating on the second device, having been used to start the authentication session; receive, from the first device, a second identifying data string, the second identifying data string originating from a-the trusted agent, configured as software or hardware, residing on the second device; and upon confirmation of a match of the first identifying data string and the second identifying data string, authorize the action. ### Claim 9 (depends on 1) The authentication apparatus of claim 1, wherein the at least one memory and the computer program code are further configured to, with the processor, cause the apparatus to: receive data indicative of a biometric input at the first device; and preceding authorization of the action, confirming a match of the data indicative of the biometric input to stored biometric data associated with a user of the first device. ### Claim 10 (depends on 1) The authentication apparatus according to claim 1, wherein the at least one memory and the computer program code configured to cause the first device to communicate with the second device to verify the proximity of the first device and the second device is further configured to, with the processor, cause the apparatus to: receive an indication of a location of the first device by means of GPS, Wi-Fi, or mobile network location information; compare the location of the first device to a location of the second device, the second device having a verifiable or confirmed location and being independent to the first device; verifying the proximity of the first device to the second device, confirming the location of the first device based on the verifiable or confirmed location of the second device. ### Claim 11 (depends on 1) The authentication apparatus according to claim 1, wherein the at least one memory and the computer program code are further configured to, with the processor, cause the apparatus to: upon determination of the location of the first device and preceding authorization of the action, determine the location is within a predefined authorized geo-region. ### Claim 12 (depends on 1) The authentication apparatus according to claim 1, wherein the at least one memory and the computer program code are further configured to, with the processor, cause the apparatus to: upon determination of the location of the first device and preceding authorization of the action, determine the location is within a predefined range of a pre-defined authorized location. ### Claim 13 (depends on 1) The authentication apparatus according to claim 1, wherein the at least one memory and the computer program code are further configured to, with the processor, cause the apparatus to: upon determination of the location of the first device and preceding authorization of the action, determine the location is not within a predefined un-authorized geo-region. ### Claim 14 (depends on 1) The authentication apparatus according to claim 1, wherein the at least one memory and the computer program code are further configured to, with the processor, cause the apparatus to: upon determination of the location of the first device by means of GPS, Wi-Fi, or mobile network location information and preceding authorization of the action, receive input at a third device; and upon verification of input at the third device, authorize the action. ### Claim 15 A computer program product configured for verifying, validating or otherwise confirming a location of a first device, using a second device before enabling or allowing an action, the computer program product comprising at least one non-transitory computer-readable storage medium having computer-executable program code instructions stored therein, the computer-executable program code instructions comprising program code instructions for: receiving a request, via an authentication session established during a log-in process, to cause the action from the second device; in response to receiving the request, sending an alert to the first device associated with an account associated with the requested action enabling receiving or transmitting of short range wireless communication protocol; causing the first device to communicate, via the short range wireless communication protocol, with the second device to verify a proximity of the first device and the second device; receiving verification of the proximity from the first device; causing a trusted agent residing on the second device to send identification information to the first device, the identification information being information that uniquely identifies the trusted agent; receiving, from the second device, a first identifying data string, the first identifying data string originating in a browser, operating on the second device, having been used to start the authentication session; receiving, from the first device, a second identifying data string, the second identifying data string originating from the trusted agent, configured as software or hardware, residing on the second device; and upon confirmation of a match of the first identifying data string and the second identifying data string, authorizing the action. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the computer-executable program code instructions further comprise program code instructions for: receiving data indicative of a biometric input at the first device; and preceding authorization of the action, confirming a match of the data indicative of the biometric input to stored biometric data associated with a user of the first device. ### Claim 17 (depends on 15) The computer program product according to claim 15, wherein the computer-executable program code instructions for causing the first device to communicate with the second device to verify the proximity of the first device and the second device, further comprise program code instructions for: receiving an indication of a location of the first device by means of GPS, Wi-Fi, or mobile network location information; comparing the location of the first device to a location of the second device, the second device having a verifiable or confirmed location and being independent to the first device; verifying the proximity of the first device to the second device, confirming the location of the first device based on the verifiable or confirmed location of the second device. ### Claim 18 (depends on 15) The computer program product according to claim 15, wherein the computer-executable program code instructions further comprise program code instructions for: upon determination of the location of the first device and preceding authorization of the action, determining the location is within a predefined authorized geo-region. ### Claim 19 (depends on 15) The computer program product according to claim 15, wherein the computer-executable program code instructions further comprise program code instructions for: upon determination of the location of the first device and preceding authorization of the action, determining the location is within a predefined range of a pre-defined authorized location. ### Claim 20 (depends on 15) The computer program product according to claim 15, wherein the computer-executable program code instructions further comprise program code instructions for: upon determination of the location of the first device and preceding authorization of the action, determining the location is not within a predefined un-authorized geo-region. ### Claim 21 (depends on 15) The computer program product according to claim 15, wherein the computer-executable program code instructions further comprise program code instructions for: upon determination of the location of the first device by means of GPS, Wi-Fi, or mobile network location information and preceding authorization of the action, receive input at a third device; and upon verification of input at the third device, authorizing the action.