# US 12,192,188 B2 · System and method for proximity-based authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,188 B2
- Document ID: US12192188B2
- Status: Granted
- Kind: B2
- Application number: 17/597,363
- Filed: 2020-07-10
- Published: 2022-08-11
- Granted: 2025-01-07
- Earliest claimed: 2019-07-12
- Assignees: Entersekt International Limited
- Applicants: Entersekt International Limited
- Inventors: Daniël Deetlefs Bester; Gerhard Gysbert Oosthuizen; Francois Archibald Nolte; Petrus Johannes De Wet
- Web page: https://patentgrep.com/patent/US12192188B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 9/3271: {using challenge-response}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04W 12/06: Authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system and method for proximity-based authentication are provided. The method conducted at a server includes receiving identification data from a primary user session on a session end point hosted on a computing device, the identification data being usable in linking the primary user session to a user record associated with a registered user. The server provides a token to one of the session end point and a registered end point hosted on a computing device, the registered end point associated with the user record, for local transmission from the end point for proximity-based acquisition by the other one of the session end point and a registered end point. The server receives the token from the other one of the session end point and the registered end point to establish physical proximity of the session end point and the registered end point during the primary user session.

## Claims

### Claim 1

A computer-implemented method for proximity-based authentication, the method conducted at a server comprising:
receiving identification data from a primary user session on a session end point hosted on
a computing device, the identification data linking the primary user session to a user record associated with a registered user;
determining a trust indicator of the primary user session, and, when the trust indicator is insufficient, requiring proximity-based acquisition to be performed by a registered end point including providing a token to one of the session end point and the registered end point hosted on a computing device, the registered end point associated with the user record, for local transmission from the end point for proximity-based acquisition by the other one of the session end point and a registered end point; and
receiving the token from the other one of the session end point and the registered end point to establish physical proximity of the session end point and the registered end point during the primary user session.

### Claim 2 (depends on 1)

The method as claimed in claim 1, including receiving and interpreting risk data to determine a risk level associated with the primary user session;
detecting that the risk level exceeds a predetermined threshold; and
in response to the detection, providing the token.

### Claim 3 (depends on 2)

The method as claimed in claim 2, wherein the risk data includes one or more risk factors of the primary user session selected from a list including: data relating to user characteristics, device characteristics, browser location, user behavioural data, or a lack of a legitimate browser fingerprint.

### Claim 4 (depends on 2)

The method as claimed in claim 2, including monitoring the risk data, and uniquely associating the risk data with the user record, and wherein determining the risk level includes comparing current risk data to previously monitored data associated with the user record.

### Claim 5 (depends on 1)

The method as claimed in claim 1, wherein providing a token is initiated in response to receiving a possession-based authentication response purporting to establish possession of the registered end point uniquely associated with the user record.

### Claim 6 (depends on 5)

The method as claimed in claim 5, wherein the method includes:
receiving the possession-based authentication response from the registered end point; and,
verifying the received possession-based authentication response including confirming that the possession-based authentication response is received from the registered end point,
wherein the possession-based authentication response indicates the registered user's intention to conduct a transaction.

### Claim 7 (depends on 1)

The method as claimed claim 1, wherein the token is provided to the session end point, and wherein the method includes transmitting an acquisition prompt message to the registered end point prompting acquisition of the token from the primary user session using the registered end point.

### Claim 8 (depends on 7)

The method as claimed in claim 7, wherein the acquisition prompt message includes a report initiation element which initiates transmission of a report message to the server, wherein the report message reports suspicious activity.

### Claim 9 (depends on 1)

The method as claimed in claim 1, wherein the method includes utilising a challenge-response authentication to authenticate the primary user session.

### Claim 10 (depends on 1)

The method as claimed in claim 1, wherein the method comprises a challenge-response authentication is-utilised to determine the trust indicator of the primary user session.

### Claim 11 (depends on 1)

The method as claimed in claim 1, wherein the primary user session is a browser session and receiving the identification data from the browser session includes receiving a challenge-response including a challenge having been signed with a private key unique and accessible to the browser session and having a corresponding public key associated with the user record.

### Claim 12 (depends on 11)

The method as claimed in claim 11, wherein the challenge-response is received together with a browser certificate, wherein the browser certificate is stored in a secure storage location accessible to the browser session while the browser session is active, and wherein the browser certificate includes the public key associated with the user record.

### Claim 13 (depends on 12)

The method as claimed in claim 12, wherein the browser certificate is generated by a certificate authority which is in communication with the server and the method includes validating the browser certificate, and if the bowser certificate is valid, linking the browser session to the user record.

### Claim 14 (depends on 1)

The method as claimed in claim 1, wherein the identification data includes any one or more of: a user name, a user password, a browser certificate, a browser fingerprint, or user biometrics which are associated with the user record.

### Claim 15 (depends on 1)

The method as claimed in claim 1, wherein one or more steps are performed via computer-readable program code stored in a non-transitory computer-readable medium.

### Claim 16

A computer-implemented method for proximity-based authentication, the method conducted at a computing device comprising:
transmitting identification data from a primary user session to a server, the identification
data in linking the primary user session to a user record associated with a registered user;
in response to the server determining that a trust indicator of the primary user session is insufficient, requiring proximity-based acquisition to be performed by a registered end point, either:
receiving a token from the server; and
outputting the token for proximity-based acquisition by the registered end point associated with the user record;
or:
acquiring a token by proximity-based acquisition from the registered end point associated with the user record; and
transmitting the token to the server to establish physical proximity of the registered end point and computing device of the primary user session.

### Claim 17 (depends on 16)

The method as claimed in claim 16, including receiving a prompt to output the token or to acquire the token from the registered end point.

### Claim 18 (depends on 16)

The method as claimed in claim 16, including transmitting risk data to the server for interpretation by the server in determining a risk level associated with the primary user session.

### Claim 19

A system for proximity-based authentication, the system including a server having a memory for storing computer-readable program code and a processor for executing the computer-readable program code which causes the processor to perform operations of:
receiving identification data from a primary user session on a session end point hosted on a computing device, the identification
data in linking the primary user session to a user record associated with a registered user;
determining a trust indicator of the primary user session, and, when the trust indicator is insufficient, requiring proximity-based acquisition to be performed by a registered end point including providing a token to one of the session end point and the
registered end point hosted on a computing device, the registered end point associated with the user record, for local transmission from the end point for proximity-based acquisition by the other one of the session end point and a registered end point; and
receiving the token from the other one of the session end point and the registered end point to establish physical proximity of the session end point and the registered end point during the primary user session.

### Claim 20 (depends on 19)

The system as claimed in claim 19, wherein the computer-readable program code causes the processor to perform further operations of:
receiving and interpreting risk data to determine a risk level associated with the primary user session; and
detecting that the risk level exceeds a predetermined threshold.