# US 11,310,224 B2 · Enhanced security authentication system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,224 B2
- Document ID: US11310224B2
- Status: Granted
- Kind: B2
- Application number: 15/433,921
- Filed: 2017-02-15
- Published: 2018-08-16
- Granted: 2022-04-19
- Earliest claimed: 2017-02-15
- Assignees: ADP, Inc.
- Applicants: ADP, Inc.
- Inventors: Roberto A. Masiero; Justo D. Pastor; Vincent Civetta; Deepak Kaushal; Francisco Villavicencio; Sanjoli Ahuja; Madusudhanan Ragothaman; Michael Nepomnyashy; Krishna Chaitanya Pinnamaneni; Nishant Kaushik; Zhitao Steve Xu; Philip M. O'Neill; Neha Pahwa
- Web page: https://patentgrep.com/patent/US11310224B2

## CPC

- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- G06F 21/36: by graphic or iconic representation
- G06F 21/43: wireless channels
- H04L 63/105: {Multiple levels of security}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- H04L 2463/082: applying multi-factor authentication
- H04W 12/63: Location-dependent; Proximity-dependent
- H04W 12/77: Graphical identity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method, computer system and computer program product for authenticating a transaction is provided. A service provider receives a transaction between a user and a website displayed on a first device. The service provider identifies a first geolocation of the first device. The service provider generates a code for display on the first device. The service provider receives credential information to identify the user and the code from a second device. The service provider identifies a second geolocation of the second device, and determines a level of risk for the transaction based at in part on the first geolocation and the second geolocation. In response to the level of risk being an acceptable level of risk, the service provider authenticates the user. The service provider generates information to enable the user on the first device to perform the transaction with the website, and sends the information to the website.

## Claims

### Claim 1

A method for authenticating a transaction of a user, the method comprising:
receiving by a service provider a transaction between a user and a website displayed on a first device;
identifying by the service provider a first geolocation of the first device;
generating by the service provider a code for display on the first device;
receiving by the service provider from a second device credential information to identify the user;
receiving by the service provider the code from the second device;
identifying by the service provider a second geolocation of the second device;
determining, by the service provider, a level of risk for the transaction based at in part on the first geolocation, the second geolocation, and a self-learning statistical evaluation of device profiling, behavioral profiling, and known fraud patterns to generates a numeric risk score for the transaction;
in response to determining that the level of risk is an acceptable level of risk, authenticating the user;
generating, by the service provider, information to enable the user on the first device to perform the transaction with the website; and
sending the information from the service provider to the website.

### Claim 2 (depends on 1)

The method of claim 1, wherein the transaction is a login of the user with the website on the first device.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first geolocation is identified from an internet protocol address of the first device.

### Claim 4 (depends on 3)

The method of claim 3, wherein identifying the first geolocation further comprises:
identifying the internet protocol address of the first device within a geolocation database; and
identifying a geolocation associated with the first device in the geolocation database, wherein the geolocation is selected from wherein the geolocation is selected from at least one of a country, a region, a city, a zip code, a latitude, a longitude, and a time zone.

### Claim 5 (depends on 1)

The method of claim 1, wherein the second geolocation is identified from at least one of global positioning location information of the second device, and triangulation signal location information of the second device.

### Claim 6 (depends on 1)

The method of claim 1, wherein determining the level of risk for the transaction further comprises:
determining a location proximity between the first device and the second device; and
determining that the level of risk is the acceptable level of risk when the location proximity between the first device and the second device is less than a proximity threshold.

### Claim 7 (depends on 1)

The method of claim 1, wherein the code is a single use quick response (QR) code, wherein generating the code further comprises:
dynamically generating the single use quick response (QR) code for display on the first device; and
receiving the QR code from the second device, wherein the second device is a mobile device having a camera configured to scan the QR code displayed on the first device.

### Claim 8 (depends on 1)

The method of claim 1, wherein generating information to enable the website to perform the transaction with the user on the first device further comprises:
generating by the service provider a cookie to enable the user to perform the transaction with the website on the first device; and
sending the cookie from the service provider to the first device.

### Claim 9

A computer system comprising:
a hardware processor; and
an authentication system in communication with the processor and configured:
to receive a transaction between a user and a website displayed on a first device;
to identify a first geolocation of the first device;
to generate a code for display on the first device;
to receive credential information from a second device to identify the user;
to receive the code from the second device;
to identify a second geolocation of the second device;
to determine a level of risk for the transaction based at in part on the first geolocation, the second geolocation, and a self-learning statistical evaluation of device profiling, behavioral profiling, and known fraud patterns to generates a numeric risk score for the transaction;
to authenticate the user in response to determining that the level of risk is an acceptable level of risk;
to generate information to enable the website to perform the transaction with the user on the first device; and
to send the information to the website.

### Claim 10 (depends on 9)

The computer system of claim 9, wherein the transaction is a login of the user with the website on the first device.

### Claim 11 (depends on 9)

The computer system of claim 9, wherein the first geolocation is identified from an internet protocol address of the first device.

### Claim 12 (depends on 11)

The computer system of claim 11, wherein in identifying the first geolocation, the authentication system is further configured:
to identify the internet protocol address of the first device within a geolocation database; and
to identify a geolocation associated with the first device in the geolocation database, wherein the geolocation is selected from wherein the geolocation is selected from at least one of a country, a region, a city, a zip code, a latitude, a longitude, and a time zone.

### Claim 13 (depends on 9)

The computer system of claim 9, wherein the second geolocation is identified from at least one of global positioning location information of the second device, and triangulation signal location information of the second device.

### Claim 14 (depends on 9)

The computer system of claim 9, wherein in determining the level of risk for the transaction, the authentication system is further configured:
to determine a location proximity between the first device and the second device; and
to determine that the level of risk is the acceptable level of risk when the location proximity between the first device and the second device is less than a proximity threshold.

### Claim 15 (depends on 9)

The computer system of claim 9, wherein the code is a single use quick response (QR) code, and wherein in generating the code, the authentication system is further configured:
to dynamically generate the single use quick response (QR) code for display on the first device; and
to receive the QR code from the second device, wherein the second device is a mobile device having a camera configured to scan the QR code displayed on the first device.

### Claim 16 (depends on 9)

The computer system of claim 9, wherein in generating information to enable the website to perform the transaction with the user on the first device, the authentication system is further configured:
to generate a cookie to enable the user to perform the transaction with the website on the first device; and
to send the cookie from the service provider to the first device.

### Claim 17

A computer program product for authenticating a transaction of a user, the computer program product comprising:
a computer readable storage media;
first program code, stored on the computer readable storage media, for receiving a transaction between a user and a website displayed on a first device;
second program code, stored on the computer readable storage media, for identifying a first geolocation of the first device;
third program code, stored on the computer readable storage media, for generating a code for display on the first device;
fourth program code, stored on the computer readable storage media, for receiving credential information to identify the user from a second device;
fifth program code, stored on the computer readable storage media, for receiving the code from the second device;
sixth program code, stored on the computer readable storage media, for identifying a second geolocation of the second device;
seventh program code, stored on the computer readable storage media, for determining a level of risk for the transaction based at in part on the first geolocation, the second geolocation, and a self-learning statistical evaluation of device profiling, behavioral profiling, and known fraud patterns to generates a numeric risk score for the transaction;
eighth program code, stored on the computer readable storage media, for authenticating the user in response to determining that the level of risk is an acceptable level of risk;
ninth program code, stored on the computer readable storage media, for generating information to enable the user on the first device to perform the transaction with the website; and
tenth program code, stored on the computer readable storage media, for sending the information from the service provider to the website.

### Claim 18 (depends on 17)

The computer program product of claim 17, wherein the transaction is a login of the user with the website on the first device.

### Claim 19 (depends on 17)

The computer program product of claim 17, wherein the first geolocation is identified from an internet protocol address of the first device.

### Claim 20 (depends on 19)

The computer program product of claim 19, wherein second program code further comprises:
program code, stored on the computer readable storage media, for identifying the internet protocol address of the first device within a geolocation database; and
program code, stored on the computer readable storage media, for identifying a geolocation associated with the first device in the geolocation database, wherein the geolocation is selected from wherein the geolocation is selected from at least one of a country, a region, a city, a zip code, a latitude, a longitude, and a time zone.

### Claim 21 (depends on 17)

The computer program product of claim 17, wherein the second geolocation is identified from at least one of global positioning location information of the second device, and triangulation signal location information of the second device.

### Claim 22 (depends on 17)

The computer program product of claim 17, wherein the seventh program code further comprises:
program code, stored on the computer readable storage media, for determining a location proximity between the first device and the second device; and
program code, stored on the computer readable storage media, for determining that the level of risk is the acceptable level of risk when the location proximity between the first device and the second device is less than a proximity threshold.

### Claim 23 (depends on 17)

The computer program product of claim 17, wherein the code is a single use quick response (QR) code, and wherein the third program code further comprises:
program code, stored on the computer readable storage media, for dynamically generating the single use quick response (QR) code for display on the first device; and
wherein the fifth program code further comprises:
program code, stored on the computer readable storage media, for receiving the QR code from the second device, wherein the second device is a mobile device having a camera configured to scan the QR code displayed on the first device.

### Claim 24 (depends on 17)

The computer program product of claim 17, wherein the ninth program code further comprises:
program code, stored on the computer readable storage media, for generating by the service provider a cookie to enable the user to perform the transaction with the website on the first device; and
program code, stored on the computer readable storage media, for sending the cookie from the service provider to the first device.