# US 2017/0289150 A1 · Securing Remote Authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0289150 A1 - Document ID: US20170289150A1 - Status: Published application - Kind: A1 - Application number: 15/083,935 - Filed: 2016-03-29 - Published: 2017-10-05 - Earliest claimed: 2016-03-29 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Tarek B. Kamel; Adrian Frei; James Shang Kai Chou - Web page: https://patentgrep.com/patent/US20170289150A1 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 21/35: communicating wirelessly - H04L 63/0492: {by using a location-limited connection, e.g. near-field communication or limited proximity of entities} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04W 12/06: Authentication - H04W 12/63: Location-dependent; Proximity-dependent - H04W 12/77: Graphical identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Authenticating a secure session between a first user entity and an identity provider using a second user entity. The method receiving a request for a session from an entity that purports to be the first user entity. The method further includes sending authentication context from the request, and wherein the authentication context for the request arrives at the second user entity. The method further includes receiving an indication that the authentication context has been verified. As a result, the method further includes authenticating a secure session between a first user entity and an identity provider or approving a secure transaction. ## Claims ### Claim 1 A system comprising: one or more processors; and one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to authenticate a secure session between a first user entity and an identity provider using a second user entity, including instructions that are executable to configure the computer system to perform at least the following: receiving a request for a session from an entity that purports to be the first user entity; sending authentication context from the request, and wherein the authentication context for the request arrives at the second user entity, to be used in verification of the authentication context using the second user entity; receiving an indication that the authentication context has been verified; and as a result, authenticating a secure session between a first user entity and an identity provider or approving a secure transaction. ### Claim 2 (depends on 1) The system of claim 1, wherein the authentication context comprises a location of the first user entity. ### Claim 3 (depends on 1) The system of claim 1, wherein the authentication context comprises at least one of an IP address for the first user entity, or process flow information regarding authentication between the first user entity and the identity provider. ### Claim 4 In a computing environment a method of authenticating a secure session between a first user entity and an identity provider using a second user entity the method comprising: receiving a request for a session from an entity that purports to be the first user entity; sending authentication context from the request, and wherein the authentication context for the request arrives at the second user entity, to be used in verification of the authentication context using the second user entity; receiving an indication that the authentication context has been verified at the second user entity; and as a result, authenticating a secure session between a first user entity and an identity provider or approving a secure transaction. ### Claim 5 (depends on 4) The method of claim 4, wherein the authentication context comprises a location of the first user entity. ### Claim 6 (depends on 4) The method of claim 4, wherein the authentication context comprises an IP address for the first user entity. ### Claim 7 (depends on 4) The method of claim 4, wherein the authentication context comprises process flow information regarding authentication between the first user entity and the identity provider. ### Claim 8 (depends on 4) The method of claim 4, wherein the authentication context for the request arrives at the second user entity by being sent by the identity provider directly to the second user entity. ### Claim 9 (depends on 8) The method of claim 8, wherein the authentication context is automatically sent to the second user entity as a result of receiving the request for a session, as a result of the second user entity subscribing to receive notifications, ### Claim 10 (depends on 4) The method of claim 4, wherein the authentication context for the request arrives at the second user entity by being sent by the identity provider directly to the first user entity, which then sends the authentication context to the second user entity. ### Claim 11 (depends on 4) The method of claim 4, further comprising receiving the authentication context signed by the second user entity, ### Claim 12 (depends on 4) The method of claim 4, wherein the authentication context has been verified at the second user entity by receiving user input indicating that the authentication context is valid., ### Claim 13 (depends on 4) The method of claim 4, farther comprising verifying the authentication context by comparing the authentication context send to authentication context received from the second user entity. ### Claim 14 In a computing environment a method of authenticating a secure session between a first user entity and an identity provider using a second user entity the method comprising: a user using a first entity requesting a secure session with the identity provider, wherein the request is associated with authentication context for the first entity; the user receiving from the second entity the authentication context of the first entity; and the user confirming that the authentication context from the first entity and second entity match according to some predetermined criteria. ### Claim 15 (depends on 14) The method of claim 14, wherein the second entity receives the authentication context of the first entity from the first entity ### Claim 16 (depends on 15) The method of claim 15, wherein the authentication context is signed by the second entity. ### Claim 17 (depends on 15) The method of claim 15, wherein the authentication context is received by the second entity using one or more of near-field communication Bluetooth, a scanned QR code, Wi-Fi, Ethernet, ZigBee, or peer to peer. ### Claim 18 (depends on 14) The method of claim 14, wherein the second entity receives the authentication context from the identity provider. ### Claim 19 (depends on 18) The method of claim 18, wherein the location is received from the identity provider to the second entity by one or more of an established notification channel, sms, or secure authenticated connection, ### Claim 20 (depends on 14) The method of claim 14, wherein the authentication context comprises at least one of an IP address for the -first user entity, a location of the first user entity, or process flow information regarding authentication between the first user entity and the identity provider.