# US 11,909,884 B2 · Secure distributed information system for public device authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,884 B2
- Document ID: US11909884B2
- Status: Granted
- Kind: B2
- Application number: 17/810,519
- Filed: 2022-07-01
- Published: 2022-11-03
- Granted: 2024-02-20
- Earliest claimed: 2018-08-24
- Assignees: Powch, LLC
- Applicants: Powch, LLC
- Inventors: Essam Abadir; Rosco Schock
- Web page: https://patentgrep.com/patent/US11909884B2

## CPC

- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- G06F 21/31: User authentication
- G06F 21/602: {Providing cryptographic facilities or services}
- G06K 7/1413: {1D bar codes}
- G06K 7/1417: {2D bar codes}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 63/126: {the source of the received data}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- H04L 2209/72: Signcrypting, i.e. digital signing and encrypting simultaneously
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS

## Abstract

A method of performing user authentication includes by a service electronic device associated with a service, receiving, from a public electronic device, a request for a user to initiate a session of the service, generating a first security token, a first write token, a first read token, and/or a first delete token, sending the first security token, the first write token, the first read token, and/or the first delete token to a server electronic device, receiving, from the server electronic device, a key location identifier that uniquely identifies a memory location of a data store associated with the server electronic device where the first security token, the first write token, the first read token, and/or the first delete token are stored, saving the key location identifier in a data store associated with the service electronic device, generating a signed key location identifier, generating a machine-readable image that includes the key location identifier, the signed key location identifier and the first write token in an encoded format, and sending the machine-readable image to the public electronic device.

## Claims

### Claim 1

A method of performing user authentication, the method comprising:
by a service electronic device associated with a service:
receiving, from a public electronic device, a request for a user to initiate a session of the service,
generating a first security token, a first write token, a first read token, and/or a first delete token,
sending the first security token, the first write token, the first read token, and/or the first delete token to a server electronic device,
receiving, from the server electronic device, a key location identifier that uniquely identifies a memory location of a data store associated with the server electronic device where the first security token, the first write token, the first read token, and/or the first delete token are stored,
saving the key location identifier in a data store associated with the service electronic device,
generating a signed key location identifier,
generating a machine-readable image that includes the signed key location identifier in an encoded format, and
sending the machine-readable image to the public electronic device.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
by the public electronic device:
receiving the machine-readable image, and
causing the machine-readable image to be displayed on a display device of the public electronic device,
by a user electronic device:
scanning the machine-readable image to extract the signed key location identifier,
verifying that the signed key location identifier is valid for a public key associated with the service,
combining a public key associated with the user and the first write token to generate a combination value,
signing the combination value to generate a signed combination value,
encrypting the signed combination value to generate an encrypted signed combination value, and
sending the encrypted signed combination value, a second security token, a second read token, and a second key location identifier to the server electronic device, wherein the second security token and the second read token are generated by the electronic device and correspond to the user, wherein the second key location identifier uniquely identifies a second memory location of a data store associated with the server electronic device, wherein the first memory location and the second memory location are not the same.

### Claim 3 (depends on 2)

The method of claim 2, wherein signing the combination value to generate a signed combination value comprises using a private key associated with the user to sign the combination value.

### Claim 4

The method of 2, wherein encrypting the signed combination value to generate an encrypted signed combination value comprises encrypting the signed combination value using a public key associated with the service.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
by the server electronic device:
receiving the first key location identifier, the first write token and the encrypted signed combination value from the user electronic device,
verifying that the first write token corresponds to information saved at the first memory location, and
in response to verifying that the first write token corresponds to information saved at the first memory location, saving the encrypted signed combination value to the first memory location.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
by the server electronic device:
receiving the first key location identifier and the first read token from the service electronic device,
verify that the first read token corresponds to information stored at the first memory location, and
in response to verifying that the first read token corresponds to information stored at the first memory location, sending the encrypted signed combination value to the service electronic device.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
by the service electronic device:
obtaining a first decrypted combination value by decrypting the encrypted signed combination value using the private key associated with the service;
extracting the public key associated with the user from the first decrypted combination value;
using the public key to locate an account associated with the user; and
sending the second key location identifier and the second read token to the server electronic device.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
by the server electronic device:
verifying that the second read token corresponds to information stored at the second memory location, and
in response to verifying that the second read token corresponds to information stored at the second memory location, sending the encrypted signed combination value to the service electronic device.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
by the service electronic device:
obtaining a second decrypted combination value by decrypting the encrypted signed combination value received from the server electronic device using the private key associated with the service,
comparing the second decrypted combination value to the first decrypted combination value to determine if they match, and
in response to the second decrypted combination value matching the first decrypted combination value, authenticating the session.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
by the server electronic device:
receiving the first key location identifier and the first delete token from the service electronic device,
verifying that the first delete token corresponds to information stored at the first memory location, and
in response to verifying that the first delete token corresponds to information stored at the first memory location, deleting all information stored at the first memory location.

### Claim 11 (depends on 2)

The method of claim 2, further comprising:
by the server electronic device:
verifying that the second security token corresponds to information stored at the second memory location,
in response to verifying that the second security token corresponds to information stored at the second memory location, saving the second read token and the encrypted signed combination value to the second memory location.

### Claim 12

A system for performing user authentication, the system comprising:
a service electronic device associated with a service; and
a computer-readable storage medium comprising one or more programming instructions that, when executed, cause the service electronic device to:
receive, from a public electronic device, a request for a user to initiate a session of the service,
generate a first security token, a first write token, a first read token, and/or a first delete token,
send the first security token, the first write token, the first read token, and/or the first delete token to a server electronic device,
receive, from the server electronic device, a key location identifier that uniquely identifies a memory location of a data store associated with the server electronic device where the first security token, the first write token, the first read token, and/or the first delete token are stored,
save the key location identifier in a data store associated with the service electronic device,
generate a signed key location identifier,
generate a machine-readable image that includes the signed key location identifier in an encoded format, and
send the machine-readable image to the public electronic device.

### Claim 13 (depends on 12)

The system of claim 12, further comprising:
a second computer-readable storage medium comprising one or more programming instructions that, when executed, cause the public electronic device to:
receive the machine-readable image, and
cause the machine-readable image to be displayed on a display device of the public electronic device,
a third computer-readable storage medium comprising one or more programming instructions that, when executed, cause a user electronic device:
scan the machine-readable image to extract the key location identifier, the signed key location identifier and the first write token,
verify that the signed key location identifier is valid for a public key associated with the service,
combine a public key associated with the user and the first write token to generate a combination value,
sign the combination value to generate a signed combination value,
encrypt the signed combination value to generate an encrypted signed combination value, and
send the encrypted signed combination value, a second security token, a second read token, and a second key location identifier to the server electronic device, wherein the second security token and the second read token are generated by the electronic device and correspond to the user, wherein the second key location identifier uniquely identifies a second memory location of a data store associated with the server electronic device, wherein the first memory location and the second memory location are not the same.

### Claim 14 (depends on 13)

The system of claim 13, wherein the one or more programming instructions that, when executed, cause the user electronic device to sign the combination value to generate a signed combination value comprise one or more programming instructions that, when executed, cause the user electronic device to use a private key associated with the user to sign the combination value.

### Claim 15

The system of 13, wherein the one or more programming instructions that, when executed, cause the user electronic device to encrypt the signed combination value to generate an encrypted signed combination value comprise one or more programming instructions that, when executed, cause the user electronic device to encrypt the signed combination value using a public key associated with the service.

### Claim 16 (depends on 13)

The system of claim 13, further comprising a fourth computer-readable storage medium comprising one or more programming instructions that, when executed, cause the server electronic device to:
verify that the second security token corresponds to information stored at the second memory location, and
in response to verifying that the second security token corresponds to information stored at the second memory location, save the second read token and the encrypted signed combination value to the second memory location.

### Claim 17 (depends on 16)

The system of claim 16, wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
receive the first key location identifier, the first write token and the encrypted signed combination value from the user electronic device,
verify that the first write token corresponds to information saved at the first memory location, and
in response to verifying that the first write token corresponds to information saved at the first memory location, save the encrypted signed combination value to the first memory location.

### Claim 18 (depends on 17)

The system of claim 17, wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
receive the first key location identifier and the first read token from the service electronic device,
verify that the first read token corresponds to information stored at the first memory location, and
in response to verifying that the first read token corresponds to information stored at the first memory location, sending the encrypted signed combination value to the service electronic device.

### Claim 19 (depends on 18)

The system of claim 18, wherein the computer-readable storage medium further comprises one or more programming instructions that, then executed, cause the service electronic device to:
obtain a first decrypted combination value by decrypting the encrypted signed combination value using the private key associated with the service;
extract the public key associated with the user from the first decrypted combination value;
use the public key to locate an account associated with the user; and
send the second key location identifier and the second read token to the server electronic device.

### Claim 20 (depends on 19)

The system of claim 19, wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
verify that the second read token corresponds to information stored at the second memory location, and
in response to verifying that the second read token corresponds to information stored at the second memory location, sending the encrypted signed combination value to the service electronic device.

### Claim 21 (depends on 20)

The system of claim 20, wherein the computer-readable storage medium further comprises one or more programming instructions that, then executed, cause the service electronic device to:
obtain a second decrypted combination value by decrypting the encrypted signed combination value received from the server electronic device using the private key associated with the service,
compare the second decrypted combination value to the first decrypted combination value to determine if they match, and
in response to the second decrypted combination value matching the first decrypted combination value, authenticate the session.

### Claim 22 (depends on 21)

The system of claim 21, wherein the fourth computer-readable storage medium further comprises one or more programming instructions that, when executed, cause the server electronic device to:
receive the first key location identifier and the first delete token from the service electronic device,
verify that the first delete token corresponds to information stored at the first memory location, and
in response to verifying that the first delete token corresponds to information stored at the first memory location, deleting all information stored at the first memory location.