# US 11,909,765 B2 · Personal device network for user identification and authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,765 B2
- Document ID: US11909765B2
- Status: Granted
- Kind: B2
- Application number: 16/408,796
- Filed: 2019-05-10
- Published: 2019-11-07
- Granted: 2024-02-20
- Earliest claimed: 2014-11-19
- Assignees: Imprivata, Inc.
- Applicants: David M. T. Ting; Alain Slak; Kyle Vernest
- Inventors: David M. T. Ting; Alain Slak; Kyle Vernest
- Web page: https://patentgrep.com/patent/US11909765B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04W 4/02: Services making use of location information
- H04W 12/06: Authentication
- H04W 12/08: Access security
- H04W 12/63: Location-dependent; Proximity-dependent
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Established user habits in carrying multiple wirelessly detectable devices are used to provide or substantiate authentication. In some embodiments, simply detecting that expected devices are co-located within a limited spatial region is sufficient to establish that the devices are being carried by a single individual. In other embodiments, particularly where the potential for spoofing by multiple individuals is a concern, single-user possession of the devices may be confirmed by various corroborative techniques. This approach affords convenience to users, who may be working at a device that lacks the necessary modality (e.g., a fingerprint or vein reader) for strong authentication.

## Claims

### Claim 1

A method for authenticating a user seeking access to a secure resource, the method comprising:
at a first time, allowing the user to access the secure resource on a first client node on the basis of a first authentication mode in accordance with a security policy, wherein the first client node is not a wireless device of the user;
after the user has accessed the secure resource, enrolling one or more wireless devices co-located with the user and the first client node by associating the one or more wireless devices with the user in an identity database; and
at a second time after the first time, allowing the user to access the secure resource on a second client node on the basis of a second authentication mode in accordance with the security policy without requiring the first authentication mode, wherein the second authentication mode comprises co-location of one or more enrolled wireless devices with the user and the second client node.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first authentication mode comprises a biometric credential received from the user.

### Claim 3 (depends on 1)

The method of claim 1, wherein the second authentication mode comprises co-location of a plurality of enrolled wireless devices with the user and the second client node.

### Claim 4 (depends on 1)

The method of claim 1, wherein the second authentication mode comprises co-location of three or more enrolled wireless devices with the user and the second client node.

### Claim 5 (depends on 1)

The method of claim 1, wherein the second authentication mode consists of co-location of a plurality of enrolled wireless devices with the user and the second client node.

### Claim 6 (depends on 1)

The method of claim 1, wherein the second authentication mode comprises (i) co-location of one or more enrolled wireless devices with the user and the second client node and (ii) one or more of a password or confirmation of physical presence of the user via a perimeter entry monitor.

### Claim 7 (depends on 1)

The method of claim 1, wherein enrolling one or more wireless devices comprises, for each said wireless device, receiving one or more unique signatures of the wireless device from the user and storing the one or more unique signatures in the identity database.

### Claim 8 (depends on 1)

The method of claim 1, wherein enrolling one or more wireless devices comprises, for each said wireless device, (i) creating a signature for the wireless device, and (ii) storing the signature or a link thereto in the identity database.

### Claim 9 (depends on 8)

The method of claim 8, wherein creating the signature for the wireless device comprises embedding a cryptographic token on the wireless device.

### Claim 10 (depends on 8)

The method of claim 8, wherein the signature for the wireless device is generated on the basis of one or more unique properties of the wireless device.

### Claim 11 (depends on 10)

The method of claim 10, wherein the one or more unique properties of the wireless device comprises at least one of a serial number or a phone number.

### Claim 12 (depends on 1)

The method of claim 1, wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, storing an identifier associated therewith in the identity database.

### Claim 13 (depends on 1)

The method of claim 1, wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, (a) prompting the user whether or not to enroll the wireless device and (b) for wireless devices to be enrolled, storing an identifier associated therewith in the identity database.

### Claim 14 (depends on 1)

The method of claim 1, further comprising, after the user has accessed the secure resource on the first client node, (i) verifying the co-location, with the user and the first client node, of all wireless devices associated with the user in the identity database, and (ii) for any wireless device associated with the user but not co-located with the user and the first client node, at least one of (a) decrementing a counter associated with the wireless device or (b) disassociating the wireless device from the user in the identity database.

### Claim 15 (depends on 1)

The method of claim 1, wherein the first authentication mode does not comprise co-location of one or more enrolled wireless devices with the user and the first client node.

### Claim 16 (depends on 1)

The method of claim 1, wherein the second client node is not a wireless device of the user.

### Claim 17 (depends on 1)

The method of claim 1, wherein the first authentication mode comprises receiving log-in credentials input by the user on the first client node.

### Claim 18 (depends on 1)

The method of claim 1, wherein the second authentication mode further comprises receiving log-in credentials input by the user on the second client node.

### Claim 19

A method for authenticating a user seeking access to a secure resource, the user having previously accessed the secure resource on the basis of a first authentication mode in accordance with a security policy, the method comprising:
enrolling one or more wireless devices co-located with the user and a first client node by associating the one or more wireless devices with the user in an identity database; and
allowing the user to access the secure resource on a second client node on the basis of a second authentication mode in accordance with the security policy without requiring the first authentication mode, wherein the second authentication mode comprises co-location of one or more enrolled wireless devices with the user and the second client node,
wherein the second client node is not a wireless device of the user.

### Claim 20 (depends on 19)

The method of claim 19, wherein the first authentication mode comprises a biometric credential received from the user.

### Claim 21 (depends on 19)

The method of claim 19, wherein enrolling one or more wireless devices comprises, for each said wireless device, receiving one or more unique signatures of the wireless device from the user and storing the one or more unique signatures in the identity database.

### Claim 22 (depends on 19)

The method of claim 19, wherein enrolling one or more wireless devices comprises, for each said wireless device, (i) creating a signature for the wireless device, and (ii) storing the signature or a link thereto in the identity database.

### Claim 23 (depends on 19)

The method of claim 19, wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, storing an identifier associated therewith in the identity database.

### Claim 24 (depends on 19)

The method of claim 19, wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, (a) prompting the user whether or not to enroll the wireless device and (b) for wireless devices to be enrolled, storing an identifier associated therewith in the identity database.

### Claim 25 (depends on 19)

The method of claim 19, wherein the first authentication mode does not comprise co-location of one or more enrolled wireless devices with the user and the first client node.

### Claim 26 (depends on 19)

The method of claim 19, wherein the second authentication mode further comprises receiving log-in credentials input by the user on the second client node.

### Claim 27 (depends on 19)

The method of claim 19, further comprising, before allowing the user to access the secure resource on the second client node, (i) verifying the co-location, with the user and the first client node, of all wireless devices associated with the user in the identity database, and (ii) for any wireless device associated with the user but not co-located with the user and the first client node, at least one of (a) decrementing a counter associated with the wireless device or (b) disassociating the wireless device from the user in the identity database.