# US 10,504,111 B2 · Secure mobile device transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,504,111 B2
- Document ID: US10504111B2
- Status: Granted
- Kind: B2
- Application number: 13/802,431
- Filed: 2013-03-13
- Published: 2014-06-26
- Granted: 2019-12-10
- Earliest claimed: 2012-12-21
- Assignees: Intermec IP Corp.
- Applicants: Intermec IP Corp.
- Inventors: H. Sprague Ackley
- Web page: https://patentgrep.com/patent/US10504111B2

## CPC

- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/3274: {using a pictured code, e.g. barcode or QR-code, being displayed on the M-device}
- H04M 1/72403: with means for local support of applications that increase the functionality
- H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
- H04W 12/06: Authentication
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods are described for communicating private user information from a mobile device to a transaction terminal or other external device. More specifically, systems and methods are described for improving authentication through the use of mobile devices used to facilitate transactions with external devices. The authentication described herein can be adaptive, thereby providing a flexible level of automatic on-the-spot transaction security. Unlike prior art systems, the mobile device is not required to have network connectivity. Additionally, the systems and methods described herein are easily adapted to most current systems.

## Claims

### Claim 1

A terminal comprising:
a symbol scanner configured to scan a first machine readable indicia displayed on a display screen of a mobile device,
a processor configured to:
decode the first machine readable indicia to retrieve a user information; and
determine if an authentication trigger is to be activated based on at least one of the decoding of the first machine readable indicia and the retrieved user information;
when the authentication trigger is activated at the terminal:
scan and decode a second machine readable indicium displayed on the display screen of the mobile device, wherein the second machine readable indicia comprises a response from a user of the mobile device for a challenge question displayed on the terminal; and
analyze the decoded second machine readable indicium to determine if the response in the second machine readable indicia meets a predetermined criterion.

### Claim 2 (depends on 1)

The terminal of claim 1, wherein the activation of the authentication trigger corresponds to activation of enhanced security policy, wherein in response to the activation of enhanced security policy, one or more challenge questions are displayed on the terminal.

### Claim 3 (depends on 1)

The terminal of claim 1, wherein the processor of the terminal is further configured to:
measure an amount of light generated by the display of the mobile device; and
activate the authentication trigger when the amount of light generated is less than a threshold.

### Claim 4 (depends on 1)

The terminal of claim 1, wherein the user information comprises at least one of a transaction information, wherein the transaction information corresponds to a transaction initiated by the user.

### Claim 5 (depends on 4)

The terminal of claim 4, wherein the processor is configured to:
identify a historical transaction pattern associated with the mobile device user initiating the transaction;
compare the transaction to the historical transaction pattern to determine if the transaction falls within a threshold of historical transactions; and
activate the authentication trigger if the transaction information does not fall within the threshold of historical transactions.

### Claim 6

A terminal comprising:
a symbol scanner configured to scan a first machine readable symbol displayed on a display screen of a mobile device;
a processor configured to:
decode the first machine readable symbol to retrieve a user information;
determine that an adaptive security policy is required for authentication based, at least in part, on an authentication trigger; and
when the enhanced security policy is determined to be required:
determine if a response in the second machine-readable symbol scanned from the symbol scanner meets predetermined criteria, wherein the second machine-readable symbol comprises a response from a user of the mobile device for a challenge question displayed on the terminal;
authenticate the mobile device when the response meets the predetermined criteria.

### Claim 7 (depends on 6)

The terminal of claim 6, wherein the adaptive security policy comprises using one or more challenge questions for authentication.

### Claim 8 (depends on 6)

The terminal of claim 6, further comprising:
a proximity detector configured to detect when the mobile device is located within a predefined scanning proximity of the terminal; and
the symbol scanner configured to automatically scan the first machine readable symbol and second machine readable symbol when the mobile device is within a predefined scanning proximity of the terminal.

### Claim 9

A method performed by a terminal, the method comprising:
scanning by a symbol scanner of the terminal a first symbol displayed on a display screen of a mobile device,
decoding, by a processor the first symbol to retrieve user information;
determining if an authentication trigger is to be activated based on at least one of the decoding of the first symbol and the retrieved user information;
upon activation of the authentication trigger at the terminal:
displaying, by the terminal, a first challenge question;
scanning, by the symbol scanner, a second symbol, wherein the second symbol is a response to the first challenge question received at the mobile device from a user;
decoding, by a processor the second symbol to retrieve the response;
determining, by the processor if the response meets a predetermined criteria.

### Claim 10 (depends on 9)

The method of claim 9, wherein the activation of the authentication trigger corresponds to activation of enhanced security policy, wherein in response to the activation of enhanced security policy, one or more challenge questions are displayed on the terminal.

### Claim 11 (depends on 9)

The method of claim 9, wherein the terminal displays other challenge questions based on the retrieved response.

### Claim 12 (depends on 9)

The method of claim 9 further comprising:
measuring an amount of light generated by the display of the mobile device; and
activating the authentication trigger when the amount of light generated is less than a threshold.

### Claim 13 (depends on 9)

The method of claim 9, wherein the retrieved user information comprises at least one of a transaction information, wherein the transaction information corresponds to a transaction initiated by the user.

### Claim 14 (depends on 9)

The method of claim 9 further comprising
identifying, by the terminal, a historical transaction pattern associated with a mobile device user initiating the transaction;
comparing, by the terminal, the transaction to the historical transaction pattern to determine if the transaction falls within a threshold of historical transactions; and
activate, by the terminal, the authentication trigger if the transaction does not fall within the threshold of historical transactions.

### Claim 15 (depends on 9)

The method of claim 9, wherein determining if an authentication trigger is to be activated based on at least one of the decoding of the first symbol and the retrieved user information comprises:
measuring an amount of light generated by the display of the mobile device; and
activating the authentication trigger when the amount of light generated by the display is less than a threshold.