# US 2018/0324190 A1 · Global attestation procedure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324190 A1 - Document ID: US20180324190A1 - Status: Published application - Kind: A1 - Application number: 16/025,124 - Filed: 2018-07-02 - Published: 2018-11-08 - Earliest claimed: 2016-09-19 - Assignees: International Business Machins Corporation - Applicants: International Business Machins Corporation - Inventors: Saritha Arunkumar; Diyanesh B. Chinnakkonda Vidyapoornachary; Saravanan Sethuraman - Web page: https://patentgrep.com/patent/US20180324190A1 ## CPC - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - G06F 16/29: Geographical information databases - G06F 16/951: Indexing; Web crawling techniques - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 4/023: {using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds} - H04W 12/06: Authentication - H04W 12/08: Access security - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/63: Location-dependent; Proximity-dependent - H04W 12/64: using geofenced areas - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method, computer program product, and system for authenticating a computing device by geographic attestation includes a processor utilizing executing an authentication application utilizing location services executing on the computing device to obtain location data from the location services. The processor obtains the location data and creates and encodes a data structure in a secured area of a memory; the data structure is only accessible to the authentication application. The processor transmits to an authentication server, an authentication request that includes the encoded location data, requesting access to secure content. The processor obtains a request to query identifiers proximate to the computing device for additional location information and queries the identifiers and transmits this additional location information to the authentication server. The processor receives a notification and based on obtaining the notification, erases the secured area and turns off the location services on the computing device. ## Claims ### Claim 1 A computer-implemented method, comprising: utilizing, by one or more processors on a computing device, executing one or more programs of an authentication application, location services executing on the computing device to obtain location data from the location services, wherein the location data indicates a physical location of the computing device contemporaneously with the executing; based on obtaining the location data, creating and encoding, by the one or more processors, a data structure from the location data in a secured area of a memory of the computing device, wherein the data structure is only accessible to the authentication application; transmitting, by the one or more processors, to an authentication server, an authentication request, wherein the authentication request comprises the encoded location data, and the authentication request is a request for access to secure content via the authentication server; obtaining, by the one or more processors, from the authentication server, a request to query identifiers geographically proximate to the computing device for additional location information, wherein geographically proximate to the computing device comprises within a pre-defined perimeter around the physical location of the computing device; responsive to the request, querying, by the one or more processors, the identifiers for the additional location information, wherein the additional location information comprises location data originating from each of the identifiers, indicating a location of each of the identifiers, and transmitting the additional location information to the authentication server; obtaining, by the one or more processors, a notification, responsive to the authentication request, from the authentication server; and based on obtaining the notification, erasing, by the one or more processors, the secured area and turning off the location services on the computing device. ### Claim 2 (depends on 1) The computer-implemented of claim 1, further comprising: prior to utilizing the location services, initiating, by the one or more processors, the location services on the computing device. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the authentication server decodes the encoded location data and compares the decoded location data to the additional location information to determine if the decoded location data and the additional location information indicate locations in a similar geographic area, wherein the similar geographic area comprises the pre-defined perimeter around the physical location of the computing device. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the decoded location data comprises a latitudinal coordinate and a longitudinal coordinate, describing a position of the computing device comprising the physical location of the computing device. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the decoded location data and the additional location information indicate locations in the similar geographic area when the latitudinal coordinate and the longitudinal coordinate describing the position of the computing device indicate a location in a virtual polygon defining a geographic area and the additional location information comprises latitudinal coordinates and longitudinal coordinates indicating additional locations in the virtual polygon, wherein a perimeter of the virtual polygon comprises the pre-defined perimeter around the physical location of the computing device. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the notification is selected from the group consisting of: an authorization to access the secured content and a denial of access to the secured content. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the notification comprises the authorization to access the secured content and the method further comprises: accessing, by the one or more processors, a portion of the secured content via the authentication server. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the encoding comprises generating an encryption key, wherein the authentication application utilizes the encryption key to access the data. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising: prior to obtaining the notification, obtaining, by the one or more processors, an access request to access the data structure in the secured area of the memory, wherein the access request does not comprise the encryption key; responsive to the access request, deleting, by the one or more processors, the data structure. ### Claim 10 (depends on 1) The computer-implemented of claim 1, wherein the secured area of the memory is selected from the group consisting of: a portion of Non-Volatile Memory, and Flash backed Dynamic Random Access Memory. ### Claim 11 A computer program product comprising: a computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising: utilizing, by the one or more processors on a computing device, executing one or more programs of an authentication application, location services executing on the computing device to obtain location data from the location services, wherein the location data indicates a physical location of the computing device contemporaneously with the executing; based on obtaining the location data, creating and encoding, by the one or more processors, a data structure from the location data in a secured area of a memory of the computing device, wherein the data structure is only accessible to the authentication application; transmitting, by the one or more processors, to an authentication server, an authentication request, wherein the authentication request comprises the encoded location data, and the authentication request is a request for access to secure content via the authentication server; obtaining, by the one or more processors, from the authentication server, a request to query identifiers geographically proximate to the computing device for additional location information, wherein geographically proximate to the computing device comprises within a pre-defined perimeter around the physical location of the computing device; responsive to the request, querying, by the one or more processors, the identifiers for the additional location information, wherein the additional location information comprises location data originating from each of the identifiers, indicating a location of each of the identifiers, and transmitting the additional location information to the authentication server; obtaining, by the one or more processors, a notification, responsive to the authentication request, from the authentication server; and based on obtaining the notification, erasing, by the one or more processors, the secured area and turning off the location services on the computing device. ### Claim 12 (depends on 11) The computer program product of claim 11, the method further comprising: prior to utilizing the location services, initiating, by the one or more processors, the location services on the computing device. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein the authentication server decodes the encoded location data and compares the decoded location data to the additional location information to determine if the decoded location data and the additional location information indicate locations in a similar geographic area, wherein the similar geographic area comprises the pre-defined perimeter around the physical location of the computing device. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the decoded location data comprises a latitudinal coordinate and a longitudinal coordinate, describing a position of the computing device comprising the physical location of the computing device. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein the decoded location data and the additional location information indicate locations in a similar geographic area when the latitudinal coordinate and the longitudinal coordinate describing the position of the computing device indicate a location in a virtual polygon defining a geographic area and the additional location information comprises latitudinal coordinates and longitudinal coordinates indicating additional locations in the virtual polygon, wherein a perimeter of the virtual polygon comprises the pre-defined perimeter around the physical location of the computing device. ### Claim 16 (depends on 11) The computer program product of claim 11, wherein the notification is selected from the group consisting of: an authorization to access the secured content and a denial of access to the secured content. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the notification comprises the authorization to access the secured content and the method further comprises: accessing, by the one or more processors, a portion of the secured content via the authentication server. ### Claim 18 (depends on 11) The computer program product of claim 11, wherein the encoding comprises generating an encryption key, wherein the authentication application utilizes the encryption key to access the data. ### Claim 19 (depends on 18) The computer program product of claim 18, the method further comprising: prior to obtaining the notification, obtaining, by the one or more processors, an access request to access the data structure in the secured area of the memory, wherein the access request does not comprise the encryption key; responsive to the access request, deleting, by the one or more processors, the data structure. ### Claim 20 A system comprising: a memory; one or more processors in communication with the memory; and program instructions executable by the one or more processors coupled to the memory to perform a method, the method comprising: utilizing, by the one or more processors on a computing device, executing one or more programs of an authentication application, location services executing on the computing device to obtain location data from the location services, wherein the location data indicates a physical location of the computing device contemporaneously with the executing; based on obtaining the location data, creating and encoding, by the one or more processors, a data structure from the location data in a secured area of a memory of the computing device, wherein the data structure is only accessible to the authentication application; transmitting, by the one or more processors, to an authentication server, an authentication request, wherein the authentication request comprises the encoded location data, and the authentication request is a request for access to secure content via the authentication server; obtaining, by the one or more processors, from the authentication server, a request to query identifiers geographically proximate to the computing device for additional location information, wherein geographically proximate to the computing device comprises within a pre-defined perimeter around the physical location of the computing device; responsive to the request, querying, by the one or more processors, the identifiers for the additional location information, wherein the additional location information comprises location data originating from each of the identifiers, indicating a location of each of the identifiers, and transmitting the additional location information to the authentication server; obtaining, by the one or more processors, a notification, responsive to the authentication request, from the authentication server; and based on obtaining the notification, erasing, by the one or more processors, the secured area and turning off the location services on the computing device.