# US 10,771,458 B1 · Proximity-based user authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,458 B1 - Document ID: US10771458B1 - Status: Granted - Kind: B1 - Application number: 15/955,277 - Filed: 2018-04-17 - Granted: 2020-09-08 - Earliest claimed: 2017-04-17 - Assignees: MicoStrategy Incorporated - Applicants: MicroStrategy Incorporated - Inventors: Feng Xia; Siamak Ziraknejad; Liang Chen; Quan Jia - Web page: https://patentgrep.com/patent/US10771458B1 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 67/52: specially adapted for the location of the user terminal - H04W 4/02: Services making use of location information - H04W 4/023: {using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds} - H04W 12/06: Authentication - H04W 12/64: using geofenced areas - H04L 63/0815: {providing single-sign-on or federations} - H04W 12/50: Secure pairing of devices - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods, systems, and apparatus, including computer programs encoded on a computer-readable storage medium, for automatically providing a user with access to a secured resource. In some implementations, a client device detects that a second device that has been designated as an authentication for a user is within a predetermined level of proximity to the client device. The client device sends data indicating that the second device is within the predetermined level of proximity of the client device to a server system. The client device receives data indicating an attempt to access a resource using the client device while the second device is within the predetermined level of proximity to the client device. The client device sends an authentication request to the server system. The client device receives data indicating approval of the authentication request and provides access to the resource. ## Claims ### Claim 1 A method comprising: detecting, by a client device, a change in a proximity status of a second device that has been designated as an authentication token for a user, wherein the change in the proximity status indicates that the second device has entered a predetermined level of proximity of the client device after previously being outside the predetermined level of proximity; in response to detecting the change in proximity status indicating that the second device has entered the predetermined level of proximity to the client device, sending, by the client device and to a server system, a proximity status change message indicating that the proximity status has changed such that the second device has entered the predetermined level of proximity of the client device; after sending the proximity status change message indicating that the second device entered the predetermined level of proximity of the client device, determining, by the client device, that the proximity status of the second device is maintained based on detecting the second device remaining within the predetermined level of proximity of the client device; after determining that the proximity status of the second device is maintained, receiving, by the client device, data indicating an attempt to access a resource using the client device while the second device is within the predetermined level of proximity to the client device; in response to receiving the data indicating the attempt to access the resource, sending, by the client device, an authentication request to the server system; receiving, by the client device and from the server system, data indicating approval of the authentication request determined based on the proximity status of the second device that the client device determined before the attempt to access the resource; and providing, by the client device, access to the resource based on receiving the data indicating approval of the authentication request. ### Claim 2 (depends on 1) The method of claim 1, wherein determining that the proximity status of the second device is maintained comprises periodically verifying that a wireless connection is maintained between the client device and the second device. ### Claim 3 (depends on 1) The method of claim 1, wherein receiving the data indicating the attempt to access the resource comprises: receiving data indicating an attempt by the user to access the resource after the user has been authenticated to access the client device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, by the client device, data from the second device over a short-range wireless communication link; and using, by the client device, the data from the second device to verify an identify of the second device or verify that the second device has been previously registered as an authentication token for the user. ### Claim 5 (depends on 1) The method of claim 1, wherein sending the authentication request to the server system comprises sending the authentication request to the server system without checking proximity of the second device after receiving the attempt. ### Claim 6 (depends on 1) The method of claim 1, wherein access to the resource is provided without requiring user input to the client device or the second device following the attempt to access the resource, and without requiring communication between the server system and the second device following the attempt to access the resource. ### Claim 7 (depends on 1) The method of claim 1, further comprising, after providing access to the resource: determining, by the client device, that the second device is no longer within the predetermined level of proximity of the client device; and in response to determining that that the second device is no longer within the predetermined level of proximity of the client device, sending, by the client device to the server system, a second proximity status change message indicating that the second device is no longer within the predetermined level of proximity of the client device. ### Claim 8 (depends on 7) The method of claim 7, further comprising: receiving, by the client device, an access revocation indication provided in response to the second proximity status change message, the access revocation indication indicating that authentication for access to the resource has been revoked; and terminating access to the resource using the client device. ### Claim 9 (depends on 1) The method of claim 1, further comprising: receiving a communication from the second device over a direct, wireless radio-frequency communication channel; and detecting that the second device has been designated as the authentication token for the user based on the communication received from the second device. ### Claim 10 (depends on 9) The method of claim 9, wherein detecting that the second device has been designated as an authentication token for a user is within the predetermined level of proximity of the client device comprises: determining that the second device is within the predetermined level of proximity based on determining that a signal strength of the communication from the second device satisfies a signal strength threshold. ### Claim 11 (depends on 1) The method of claim 1, further comprising, before detecting the change in proximity status indicating that the second device has entered the predetermined level of proximity to the client device, storing, in data storage of the client device, data indicating that the second device has been designated as an authentication token for the user; wherein detecting the change in the proximity status of the second device that has been designated as the authentication token for the user is within the predetermined level of proximity of the client device comprises: receiving, by the client device, a communication from another device; and based on the communication from the device, determining, by the client device, that the other device is the second device identified in the stored data in the data storage of the client device. ### Claim 12 (depends on 1) The method of claim 1, wherein receiving data indicating an attempt to access a resource using the client device comprises receiving data indicating an attempt to access a file, a local application, a remote application, a web page, a virtual private network (VPN), a network resource, or a database. ### Claim 13 (depends on 1) The method of claim 1, wherein receiving data indicating an attempt to access a resource using the client device comprises receiving data indicating user input to navigate to a web page, open a bookmark of a web browser, select an icon, or open an application. ### Claim 14 (depends on 1) The method of claim 1, wherein detecting the change in the proximity status of the second device has entered the predetermined level of proximity of the client device comprises verifying an identity of the second device based on a device identifier provided by the second device or an encryption key used by the second device. ### Claim 15 (depends on 1) The method of claim 1, wherein the second device is a mobile phone. ### Claim 16 A system comprising: one or more computers; and one or more storage devices storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising: detecting, by a client device, a change in a proximity status of a second device that has been designated as an authentication token for a user, wherein the change in the proximity status indicates that the second device has entered a predetermined level of proximity of the client device after previously being outside the predetermined level of proximity; in response to detecting the change in proximity status indicating that the second device has entered the predetermined level of proximity to the client device, sending, by the client device and to a server system, a proximity status change message indicating that the proximity status has changed such that the second device has entered the predetermined level of proximity of the client device; after sending the proximity status change message indicating that the second device entered the predetermined level of proximity of the client device, determining, by the client device, that the proximity status of the second device is maintained based on detecting the second device remaining within the predetermined level of proximity of the client device; and after determining that the proximity status of the second device is maintained, receiving, by the client device, data indicating an attempt to access a resource using the client device while the second device is within the predetermined level of proximity to the client device; in response to receiving the data indicating the attempt to access the resource, sending, by the client device, an authentication request to the server system; receiving, by the client device and from the server system, data indicating approval of the authentication request determined based on the proximity status of the second device that the client device determined before the attempt to access the resource; and providing, by the client device, access to the resource based on receiving the data indicating approval of the authentication request. ### Claim 17 (depends on 16) The system of claim 16, wherein access to the resource is provided without requiring user input to the client device or the second device following the attempt to access the resource, and without requiring communication between the server system and the second device following the attempt to access the resource. ### Claim 18 (depends on 16) The system of claim 16, wherein the operations further comprise after providing access to the resource: determining, by the client device, that the second device is no longer within the predetermined level of proximity of the client device; and in response to determining that that the second device is no longer within the predetermined level of proximity of the client device, sending, by the client device to the server system, a second proximity status change message indicating that the second device is no longer within the predetermined level of proximity of the client device. ### Claim 19 One or more non-transitory computer-readable devices encoded with computer program instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising: detecting, by a client device, a change in a proximity status of a second device that has been designated as an authentication token for a user, wherein the change in the proximity status indicates that the second device has entered a predetermined level of proximity of the client device after previously being outside the predetermined level of proximity; in response to detecting the change in proximity status indicating that the second device has entered the predetermined level of proximity to the client device, sending, by the client device and to a server system, a proximity status change message indicating that the proximity status has changed such that the second device has entered the predetermined level of proximity of the client device; after sending the proximity status change message indicating that the second device entered the predetermined level of proximity of the client device, determining, by the client device, that the proximity status of the second device is maintained based on detecting the second device remaining within the predetermined level of proximity of the client device; after determining that the proximity status of the second device is maintained, receiving, by the client device, data indicating an attempt to access a resource using the client device while the second device is within the predetermined level of proximity to the client device; in response to receiving the data indicating the attempt to access the resource, sending, by the client device, an authentication request to the server system; receiving, by the client device and from the server system, data indicating approval of the authentication request determined based on the proximity status of the second device that the client device determined before the attempt to access the resource; and providing, by the client device, access to the resource based on receiving the data indicating approval of the authentication request. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable devices of claim 19, wherein access to the resource is provided without requiring user input to the client device or the second device following the attempt to access the resource, and without requiring communication between the server system and the second device following the attempt to access the resource.