# US 2019/0171812 A1 · Authenticating application legitimacy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0171812 A1 - Document ID: US20190171812A1 - Status: Published application - Kind: A1 - Application number: 16/257,794 - Filed: 2019-01-25 - Published: 2019-06-06 - Earliest claimed: 2015-08-06 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Vijay EKAMBARAM; Sarbajit K. RAKSHIT - Web page: https://patentgrep.com/patent/US20190171812A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/44: Program or device authentication - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 21/31: User authentication - H04W 12/77: Graphical identity - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Facilities are provided herein to address application phishing by determining whether an application is a legitimate application it purports to be. Optical code(s) are displayed on a display device in association with an application to be authenticated for a user as being a legitimate application. Based on imaging the optical code(s) using a camera of a device of a user, data of the optical code(s) are obtained. It is automatically determines, based on the obtained data of the optical code(s), whether the application to be authenticated is authenticated as being the legitimate application, and based on this, an indication of whether the application is authenticated as being the legitimate application is provided for the user by the device. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining, by a user device of a user based on imaging at least one optical code using a camera of the user device of the user, data of the at least one optical code, the at least one optical code being displayed on a display device in association with an application to be authenticated for the user as being a legitimate application; automatically determining by the user device, based on the obtained data of the at least one optical code and on obtaining and comparing data from a trusted authentication entity associated with the legitimate application to the obtained data of the at least one optical code, whether the application to be authenticated is authenticated as being the legitimate application; and providing for the user, by the user device, based on the automatically determining, an indication of whether the application to be authenticated is authenticated as being the legitimate application. ### Claim 2 (depends on 1) The method of claim 1, wherein the application to be authenticated comprises a mobile application or a web application. ### Claim 3 (depends on 1) The method of claim 1, wherein the user device comprises a wearable device, and wherein the indication comprises at least one visual, haptic, or audible indication for the user. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least optical code comprises computer readable encoded information and the data of the at least one optical code comprises decoded data decoded from the encoded information. ### Claim 5 (depends on 1) The method of claim 1, further comprising triggering, during boot of the user device, checking a digital signature of an application of the user device. ### Claim 6 (depends on 5) The method of claim 5, further comprising, based on verifying the digital signature as being correct, initiating execution of the application, wherein the application at least partially performs the obtaining, the automatically determining, and the providing. ### Claim 7 (depends on 1) The method of claim 1, wherein an application running as a background application of the user device monitors for presence of an optical code in an imaging space proximate the user device. ### Claim 8 (depends on 7) The method of claim 7, wherein the obtaining, the automatically determining, and the providing are performed based on detecting presence of the optical code, the optical code being an optical code of the at least one optical code. ### Claim 9 A computer program product comprising: a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: obtaining, by a user device of a user based on imaging at least one optical code using a camera of the user device, data of the at least one optical code, the at least one optical code being displayed on a display device in association with an application to be authenticated for the user as being a legitimate application; automatically determining by the user device, based on the obtained data of the at least one optical code and on obtaining and comparing data from a trusted authentication entity association with the legitimate application to the obtained data of the at least one optical code, whether the application to be authenticated is authenticated as being the legitimate application; and providing for the user, by the user device, based on the automatically determining, an indication of whether the application to be authenticated is authenticated as being the legitimate application. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the application to be authenticated comprises a mobile application or a web application. ### Claim 11 (depends on 9) The computer program product of claim 9, wherein the method further comprises triggering, during boot of the user device, checking a digital signature of an application of the user device. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the method further comprises, based on verifying the digital signature as being correct, initiating execution of the application, wherein the application at least partially performs the obtaining, the automatically determining, and the providing. ### Claim 13 (depends on 9) The computer program product of claim 9, wherein an application running as a background application of the user device monitors for presence of an optical code in an imaging space proximate the user device. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the obtaining, the automatically determining, and the providing are performed based on detecting presence of the optical code, the optical code being an optical code of the at least one optical code. ### Claim 15 A computer system comprising: a memory; and a processor in communication with the memory, wherein the computer system is configured to perform a method, the method comprising: obtaining, by a user device of a user based on imaging at least one optical code using a camera of the user device of the user, data of the at least one optical code, the at least one optical code being displayed on a display device in association with an application to be authenticated for the user as being a legitimate application; automatically determining by the user device, based on the obtained data of the at least one optical code and on obtaining and comparing data from a trusted authentication entity associated with the legitimate application to the obtained data of the at least one optical code, whether the application to be authenticated is authenticated as being the legitimate application; and providing for the user, by the user device, based on the automatically determining, an indication of whether the application to be authenticated is authenticated as being the legitimate application. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the application to be authenticated comprises a mobile application or a web application. ### Claim 17 (depends on 15) The computer system of claim 15, wherein the method further comprises triggering, during boot of the user device, checking a digital signature of an application of the user device. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the method further comprises, based on verifying the digital signature as being correct, initiating execution of the application, wherein the application at least partially performs the obtaining, the automatically determining, and the providing. ### Claim 19 (depends on 15) The computer system of claim 15, wherein an application running as a background application of the user device monitors for presence of an optical code in an imaging space proximate the user device. ### Claim 20 (depends on 19) The computer system of claim 19, wherein the obtaining, the automatically determining, and the providing are performed based on detecting presence of the optical code, the optical code being an optical code of the at least one optical code.