# US 11,115,423 B2 · Multi-factor authentication using positioning data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,423 B2 - Document ID: US11115423B2 - Status: Granted - Kind: B2 - Application number: 16/508,247 - Filed: 2019-07-10 - Published: 2020-02-06 - Granted: 2021-09-07 - Earliest claimed: 2016-11-22 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Stephen P. DiAcetis; David Mahlon Hoover; Cristina del Amo Casado; Lanny D. Natucci, Jr.; Janet Lynn Schneider; Sanjib Saha; Fernando Gonzalez; Jonathan Matthew Kay - Web page: https://patentgrep.com/patent/US11115423B2 ## CPC - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - G06F 16/29: Geographical information databases - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/10: {for controlling access to devices or network resources} - H04W 4/021: Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/64: using geofenced areas - G07C 9/32: in combination with an identity check - H04L 2463/082: applying multi-factor authentication - H04W 4/029: Location-based management or tracking services - H04W 12/68: Gesture-dependent or behaviour-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE ## Abstract Techniques described herein provide multi-factor authentication based on positioning data. Generally described, configurations disclosed herein enable a system to authorize a particular action using positioning data, and possibly other data, associated with an identity. For example, when a user wishes to change a password or access a secured account, the system can authenticate a user if a device associated with the user is located in the secure area. The system can authenticate a user if a requested operation and/or a predetermined pattern of movement associated with the user is detected. For instance, the system allows the user to change the password when the user's computer has followed a predetermined pattern of movement, and when one or more verification procedures meets one or more criteria while the location of the computing device is within the predetermined area. ## Claims ### Claim 1 A system, comprising: at least one processor; and memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to: receive first input data indicating an authentication request of a user with respect to a secured resource; receive positioning data indicating a current location of a computing device that is associated with the user; determine, based on the positioning data, whether the current location of the computing device is within a predetermined geographic area, wherein a determination that the current location of the computing device is within the predetermined geographic area serves as a first authentication factor with respect to the authentication request; receive second input data, that is different than the first input data and the positioning data, that serves as a second authentication factor, that is independent from the first authentication factor, with respect to the authentication request by providing confirmation that the user is physically located within the predetermined geographic area independently from the positioning data indicating that the current location of the computing device is within the predetermined geographic area, wherein the second input data is generated based on a requested operation being performed with respect to one or more computing devices that are known to be physically present within the predetermined geographic area; and authenticate the user for providing access to the secured resource based at least on a combination of: the positioning data serving as the first authentication factor based on the determination that the current location of the computing device is within the predetermined geographic area, and the second input data, that is different than the first input data, serving as the second authentication factor that is independent from the first authentication factor. ### Claim 2 (depends on 1) The system of claim 1, wherein the second input data comprises biometric information that corresponds to the user and that is received while the positioning data indicates that the current location of the computing device is within the predetermined geographic area. ### Claim 3 (depends on 2) The system of claim 2, wherein the biometric information is received through a second computing device that is known to be physically present within the predetermined geographic area. ### Claim 4 (depends on 1) The system of claim 1, wherein the second input data comprises contextual data that indicates that the user is scheduled to be within the predetermined geographic area. ### Claim 5 (depends on 1) The system of claim 1, wherein the second input data is generated based on the user providing a device, that uniquely corresponds to the user, to a second computing device that is known to be physically present within the predetermined geographic area. ### Claim 6 (depends on 1) The system of claim 1, wherein the second input data is generated based on the computing device connecting to a wireless network that is accessible from within the predetermined geographic area. ### Claim 7 (depends on 1) The system of claim 1, wherein the computer-readable instructions further cause the at least one processor to terminate the access to the secured resource in response to a determination that the computing device is outside of the predetermined geographic area. ### Claim 8 (depends on 1) The system of claim 1, wherein the second input data corresponds to a determination that the user has complied with an instruction to perform a gesture within the predetermined geographic area. ### Claim 9 (depends on 1) The system of claim 1, wherein the computer-readable instructions further cause the at least one processor to: expose an instruction to perform the requested operation by way of the one or more computing devices that are known to be physically present within the predetermined geographic area, wherein the second input data is received subsequent to the instruction being exposed; and determine that the second input data corresponds to the user performing the requested operation with respect to the one or more computing devices. ### Claim 10 (depends on 1) The system of claim 1, wherein the second input data is received subsequent to both of the first input data and the positioning data. ### Claim 11 A system, comprising: at least one processor; and memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to: receive a first input indicating an authentication request of a user; receive positioning data indicating a current location of a computing device that is associated with the user; determine whether the positioning data indicates that the current location of the computing device is within a predetermined geographic area; determine whether an additional verification procedure indicates that the user is physically present within the predetermined geographic area while the positioning data indicates that the current location of the computing device is within the predetermined geographic area, wherein the additional verification procedure comprises receiving a second input indicating that the user is physically located within the predetermined area; authenticate the user for providing access to a secured resource based at least on determining that the current location of the computing device is within the predetermined geographic area and confirming execution of the additional verification procedure; and generate permission data that revokes access to the secured resource based at least on determining that a pattern of movement is inconsistent with a predetermined pattern of movement. ### Claim 12 (depends on 11) The system of claim 11, wherein the second input comprises biometric information that is associated with the user and is received while the positioning data indicates that the current location of the computing device is within the predetermined geographic area. ### Claim 13 (depends on 11) The system of claim 11, wherein the biometric information is received through a second computing device that is known to be physically present within the predetermined geographic area. ### Claim 14 (depends on 11) The system of claim 11, wherein the predetermined pattern of movement defines a travel path from a first location to the predetermined geographic area. ### Claim 15 (depends on 11) The system of claim 11, further comprising determining the pattern of movement based on additional positioning data that is received in association with the computing device. ### Claim 16 (depends on 11) The system of claim 11, wherein the second input is generated based on the user providing an authentication device, that uniquely corresponds to the user, to a second computing device that is known to be physically present within the predetermined geographic area. ### Claim 17 (depends on 11) The system of claim 11, wherein the permission data that revokes access to the secured resource prevents a password associated with the user from being changed in response to a determination that the pattern of movement is inconsistent with a predetermined pattern of movement. ### Claim 18 (depends on 11) The system of claim 11, wherein the predetermined pattern of movement is determined based on contextual data that indicates that the user is scheduled to be within the predetermined geographic area. ### Claim 19 A computer-implemented method for restricting user access to a secured resource to a predetermined geographic area, comprising: receiving first input data indicating an authentication request of a user, wherein the authentication request corresponds to the user requesting access to the secured resource; in response to the first input data, confirming a first authentication factor in association with the authentication request by: receiving positioning data indicating a current location of a computing device that is associated with the user, and determining, based on the positioning data, that the current location of the computing device is within the predetermined geographic area; in response to the first input data, confirming a second authentication factor, that is independent from the first authentication factor, in association with the authentication request by: generating a request that indicates a requested operation that is to be performed with respect to one or more computing devices that are known to be physically present within the predetermined geographic area, and receiving second input data, that is different than the first input data, that is generated based on the requested operation being performed with respect to the one or more computing devices that are known to be physically present within the predetermined geographic area; and providing the access to the secured resource in response to successfully confirming the first authentication factor and the second authentication factor that is different than and independent from the first authentication factor. ### Claim 20 (depends on 19) The computer-implemented method of claim 19, wherein the second input data corresponds to the user providing an authentication device, that uniquely corresponds to the user, to at least one of the computing device, or a second computing device that is known to be physically present within the predetermined geographic area.