# US 10,771,250 B2 · Distributed token-less authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,250 B2 - Document ID: US10771250B2 - Status: Granted - Kind: B2 - Application number: 16/058,333 - Filed: 2018-08-08 - Published: 2019-11-14 - Granted: 2020-09-08 - Earliest claimed: 2018-05-11 - Applicants: Toufic Chebaro - Inventors: Toufic Chebaro - Web page: https://patentgrep.com/patent/US10771250B2 ## CPC - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - G06Q 20/4012: {Verifying personal identification numbers [PIN]} - G06Q 20/40145: {Biometric identity checks} - G06V 40/12: Fingerprints or palmprints - G07F 7/1091: {Use of an encrypted form of the PIN} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3271: {using challenge-response} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04W 12/64: using geofenced areas - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Distributed token-less authentication. In an embodiment, a partially-hashed personal identification number (PIN) is received from a terminal via at least one first network, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion. The partially-hashed PIN is relayed to the service-specific interface, identified by the first unhashed portion of the partially-hashed PIN, via at least one second network. Subsequently, a first-level confirmation or rejection is received from the service-specific interface via the at least one second network, and the first-level confirmation or rejection is relayed to the terminal via the at least one first network. ## Claims ### Claim 1 A method comprising: by at least one hardware processor of a region-specific interface, via at least one first network, receiving a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion, via at least one second network, relaying the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN, via the at least one second network, receiving a first-level confirmation or rejection from the service-specific interface, and, via the at least one first network, relaying the first-level confirmation or rejection to the terminal; and, by the at least one hardware processor of the service-specific interface, when the first-level confirmation or rejection is a first-level confirmation, via the at least one second network, receiving a request for second-level confirmation, comprising image data of the user, from the region-specific interface, comparing the image data of the user in the request for second-level confirmation to image data of the user stored by the service-specific interface, when the image data of the user in the request for second-level confirmation matches the image data of the user stored by the service-specific interface, sending a second-level confirmation and user information associated with the user; and, when the image data of the user in the request for second-level confirmation does not match the image data of the user stored by the service-specific interface, sending a second-level rejection. ### Claim 2 (depends on 1) The method of claim 1, wherein the partially-hashed PIN further comprises an unhashed third portion that identifies a geographical region associated with the user account. ### Claim 3 (depends on 1) The method of claim 1, further comprising, by at least one hardware processor of the terminal: receiving a PIN from a user via one or more inputs of the terminal; using a hash function to hash a portion of the PIN to generate the partially-hashed PIN; and, via the at least one first network, sending the partially-hashed PIN to the region-specific interface. ### Claim 4 (depends on 3) The method of claim 3, wherein the PIN is unique to the user among all other users. ### Claim 5 (depends on 3) The method of claim 3, wherein the PIN comprises a portion derived from the user's name. ### Claim 6 (depends on 1) The method of claim 1, further comprising, by at least one hardware processor of the service-specific interface: via the at least one second network, receiving the partially-hashed PIN from the region-specific interface; determining whether or not a user record exists for the partially-hashed PIN; when a user record is determined to exist for the partially-hashed PIN, via the at least one second network, sending a first-level confirmation to the region-specific interface; and, when a user record is not determined to exist for the partially-hashed PIN, via the at least one second network, sending a first-level rejection to the region-specific interface. ### Claim 7 (depends on 1) The method of claim 1, further comprising, by the at least one hardware processor of the region-specific interface, when the first-level confirmation or rejection is a first-level confirmation: via the at least one first network, receiving the request for second-level confirmation from the terminal; via the at least one second network, relaying the request for second-level confirmation to the service-specific interface; via the at least one second network, receiving the second-level confirmation or rejection from the service-specific interface; and, via the at least one first network, relaying the second-level confirmation or rejection to the terminal. ### Claim 8 (depends on 7) The method of claim 7, further comprising, by the at least one hardware processor of the terminal: via the at least one first network, receiving the second-level confirmation or rejection from the region-specific interface; when the second-level confirmation is received and no manual override is received from an operator of the terminal, authorizing a transaction at the terminal; when the second-level confirmation is received and the manual override is received from the operator of the terminal, rejecting the transaction at the terminal; when the second-level rejection is received and no manual override is received from the operator of the terminal, rejecting the transaction at the terminal; and, when the second-level rejection is received and the manual override is received from the operator of the terminal, authorizing the transaction at the terminal. ### Claim 9 (depends on 1) The method of claim 1, wherein the at least one first network and the at least one second network are the same network. ### Claim 10 A system comprising: at least one hardware processor of a region-specific interface; one or more software modules, stored in a memory of the region-specific interface, that, when executed by the at least one hardware processor of the region-specific interface, via at least one first network, receive a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion, via at least one second network, relay the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN, via the at least one second network, receive a first-level confirmation or rejection from the service-specific interface, and, via the at least one first network, relay the first-level confirmation or rejection to the terminal; at least one hardware processor of the service-specific interface; and one or more software modules, stored in a memory of the service-specific interface, that, when executed by the at least one hardware processor of the service-specific interface, when the first-level confirmation or rejection is a first-level confirmation, via the at least one second network, receive a request for second-level confirmation, comprising image data of the user, from the region-specific interface, compare the image data of the user in the request for second-level confirmation to image data of the user stored by the service-specific interface, when the image data of the user in the request for second-level confirmation matches the image data of the user stored by the service-specific interface, send a second-level confirmation and user information associated with the user; and, when the image data of the user in the request for second-level confirmation does not match the image data of the user stored by the service-specific interface, send a second-level rejection. ### Claim 11 Non-transitory computer-readable media comprising: a first non-transitory computer-readable medium having first instructions stored therein, wherein the first instructions, when executed by a processor of a region-specific interface, cause the processor to via at least one first network, receive a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion, via at least one second network, relay the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN via the at least one second network, receive a first-level confirmation or rejection from the service-specific interface, and, via the at least one first network, relay the first-level confirmation or rejection to the terminal; and a second non-transitory computer-readable medium having second instructions stored therein, wherein the second instructions, when executed by a processor of a service-specific interface, cause the processor to, when the first-level confirmation or rejection is a first-level confirmation, via the at least one second network, receive a request for second-level confirmation, comprising image data of the user, from the region-specific interface, compare the image data of the user in the request for second-level confirmation to image data of the user stored by the service-specific interface, when the image data of the user in the request for second-level confirmation matches the image data of the user stored by the service-specific interface, send a second-level confirmation and user information associated with the user; and, when the image data of the user in the request for second-level confirmation does not match the image data of the user stored by the service-specific interface, send a second-level rejection. ### Claim 12 A method comprising: by at least one hardware processor of a region-specific interface, via at least one first network, receiving a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion, via at least one second network, relaying the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN, via the at least one second network, receiving a first-level confirmation or rejection from the service-specific interface, and, via the at least one first network, relaying the first-level confirmation or rejection to the terminal; and, by the at least one hardware processor of the terminal, via the at least one first network, receiving a second-level confirmation or rejection from the region-specific interface, when the second-level confirmation is received and no manual override is received from an operator of the terminal, authorizing a transaction at the terminal, when the second-level confirmation is received and the manual override is received from the operator of the terminal, rejecting the transaction at the terminal, when the second-level rejection is received and no manual override is received from the operator of the terminal, rejecting the transaction at the terminal, and, when the second-level rejection is received and the manual override is received from the operator of the terminal, authorizing the transaction at the terminal.