# US 11,444,950 B2 · Automated verification of authenticated users accessing a physical resource > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,950 B2 - Document ID: US11444950B2 - Status: Granted - Kind: B2 - Application number: 16/857,445 - Filed: 2020-04-24 - Published: 2021-10-28 - Granted: 2022-09-13 - Earliest claimed: 2020-04-24 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Anantha Kalyan Kumar Mulampaka; Thirupati Panyala - Web page: https://patentgrep.com/patent/US11444950B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/0838: {using one-time-passwords} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/069: using certificates or pre-shared keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are examples of a system for automated verification of the identity of a user accessing a physical resource using a client device. The client device can broadcast data to a security device. If the data includes a user credential, the security device can provide the user credential to a verification server to obtain profile information. If the data does not include a user credential, the security device can provide a verification request to the client device. If the user accepts the verification request, the client device can provide a user credential and an identity token to the security device. The security device can provide the user credential to a verification server to obtain profile information. The security device can validate the identity token using the profile information. If the user declines the verification request, the client device can instruct the user to proceed to a verification terminal. ## Claims ### Claim 1 A system comprising: a computing device comprising a processor and a memory; and a memory comprising program instructions, wherein the program instructions, when executed by the processor, cause the computing device to at least: receive beacon data from a client device associated with a user account, the beacon data comprising an enterprise identifier and a user credential field; determine whether the enterprise identifier corresponds to a particular enterprise that is associated with the computing device, the particular enterprise providing access to a physical resource; in response to determining that the enterprise identifier corresponds to the particular enterprise, determine whether the user credential field includes a user credential associated with the user account; provide the user credential to a verification server; and receive profile information corresponding to the user account from the verification server. ### Claim 2 (depends on 1) The system of claim 1, wherein the program instructions further cause the computing device to at least: in response to determining that the user credential field fails to include the user credential, send a verification request to the client device, the verification request specifying a verification method selected based at least in part on policy data stored in a data store accessible to the computing device. ### Claim 3 (depends on 2) The system of claim 2, wherein the program instructions further cause the computing device to at least: receive an identity token and the user credential from the client device; and validate the identity token based at least in part on the profile information corresponding to the user account. ### Claim 4 (depends on 3) The system of claim 3, wherein the identity token comprises biometric authentication data, and the program instructions that cause the computing device to validate the identity token based at least in part on the profile information corresponding to the user account further cause the computing device to at least: determine that the biometric authentication data matches biometric data included in the profile information corresponding to the user account. ### Claim 5 (depends on 1) The system of claim 1, wherein the program instructions further cause the computing device to at least: in response to determining that the user credential field includes the user credential, display a user icon in a display accessible to the computing device, wherein user icon includes at least a portion of the profile information. ### Claim 6 (depends on 1) The system of claim 1, wherein the beacon data is received using a Bluetooth Low Energy connection. ### Claim 7 (depends on 1) The system of claim 1, wherein the program instructions further cause the computing device to at least decrypt the user credential using a private key corresponding to a public key used by the client device to encrypt the user credential. ### Claim 8 (depends on 1) The system of claim 1, wherein the user credential comprises a badge credential. ### Claim 9 A method comprising: receiving, by a computing device, beacon data from a client device associated with a user account, the beacon data comprising an enterprise identifier and a user credential field; determining, by the computing device, whether the enterprise identifier corresponds to a particular enterprise that is associated with the computing device, the particular enterprise providing access to a physical resource; in response to determining that the enterprise identifier corresponds to the particular enterprise, determining, by the computing device, whether the user credential field includes a user credential associated with the user account; providing, by the computing device, the user credential to a verification server; and receiving, by the computing device, profile information corresponding to the user account from the verification server. ### Claim 10 (depends on 9) The method of claim 9, further comprising: in response to determining that the user credential field fails to include the user credential, sending a verification request to the client device, the verification request specifying a verification method selected based at least in part on policy data stored in a data store. ### Claim 11 (depends on 10) The method of claim 10, further comprising: receiving an identity token and the user credential from the client device; and validating the identity token based at least in part on the profile information corresponding to the user account. ### Claim 12 (depends on 11) The method of claim 11, wherein the identity token comprises biometric authentication data, and validating the identity token based at least in part on the profile information corresponding to the user account comprises: determining that the biometric authentication data matches biometric data included in the profile information corresponding to the user account. ### Claim 13 (depends on 9) The method of claim 9, further comprising: in response to determining that the user credential field includes the user credential, displaying a user icon in a display, wherein user icon includes at least a portion of the profile information. ### Claim 14 (depends on 9) The method of claim 9, wherein the beacon data is received using near-field communication. ### Claim 15 (depends on 9) The method of claim 9, wherein the user credential comprises a single-use passcode or a random string. ### Claim 16 A non-transitory computer-readable medium comprising machine-readable instructions, wherein when executed by a processor of at least one computing device, the machine-readable instructions cause the at least one computing device to at least: receive beacon data from a client device associated with a user account, the beacon data comprising an enterprise identifier and a user credential field; determine whether the enterprise identifier corresponds to a particular enterprise that is associated with the at least one computing device, the particular enterprise providing access to a physical resource; in response to determining that the enterprise identifier corresponds to the particular enterprise, determine whether the user credential field includes a user credential associated with the user account; provide the user credential to a verification server; and receive profile information corresponding to the user account from the verification server. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the machine-readable instructions further cause the at least one computing device to at least: in response to determining that the user credential field fails to include the user credential, send a verification request to the client device, the verification request specifying a verification method selected based at least in part on policy data stored in a data store accessible to the at least one computing device. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the machine-readable instructions further cause the at least one computing device to at least: receive an identity token and the user credential from the client device; and validate the identity token based at least in part on the profile information corresponding to the user account. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the identity token comprises biometric authentication data, and the machine-readable instructions that cause the at least one computing device to validate the identity token based at least in part on the profile information corresponding to the user account further cause the at least one computing device to at least: determine that the biometric authentication data matches biometric data included in the profile information corresponding to the user. ### Claim 20 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the machine-readable instructions further cause the at least one computing device to at least: in response to determining that the user credential field includes the user credential, display a user icon in a display accessible to the at least one computing device, wherein user icon includes at least a portion of the profile information.