# US 8,572,366 B1 · Authenticating clients > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,366 B1 - Document ID: US8572366B1 - Status: Granted - Kind: B1 - Application number: 13/474,876 - Filed: 2012-05-18 - Granted: 2013-10-29 - Earliest claimed: 2012-05-18 - Assignees: Google Inc. - Applicants: Navindra Yadav - Inventors: Navindra Yadav - Web page: https://patentgrep.com/patent/US8572366B1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This disclosure provides a system and method for client authentication that allows a service provider to implement multiple authentication challenges to verify a user/client. The system includes an extractor, a comparer, and an attributer. The extractor receives an Internet protocol source address from a client and extracts a media access control address. The extractor also determines a source identifier of the client from the media access control address. The comparer compares the extracted media access control address with a client media access control address associated with the client, and signals execution of one or more client authentication challenges when the extracted media access control address fails to match the at least one client media access control address associated with the client. The attributer associates the source identifier with the client after successful execution of a client authentication challenge. ## Claims ### Claim 1 A method of client authentication, the method comprising: receiving, at a computing device, an Internet protocol source address of a client; extracting, at the computing device, a media access control address from the Internet protocol source address; comparing, at the computing device, the extracted media access control address with at least one client media access control address associated with the client; signaling execution, at the computing device, of one or more client authentication challenges when the extracted media access control address fails to match the at least one client media access control address associated with the client; associating, at the computing device, the extracted media access control address with the client after successful execution of the one or more client authentication challenges; attributing, at the computing device, an age to the extracted media access control address; and disassociating, at the computing device, the extracted media access control address from the client after a threshold period of time. ### Claim 2 (depends on 1) The method of claim 1, further comprising: extracting, at the computing device, an interface identifier from the Internet protocol source address; and extracting, at the computing device, the media access control address from the interface identifier. ### Claim 3 (depends on 1) The method of claim 1, further comprising extracting, at the computing device, an organizationally unique identifier from the media access control address. ### Claim 4 (depends on 3) The method of claim 3, further comprising determining, at the computing device, a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier. ### Claim 5 (depends on 4) The method of claim 4, further comprising: comparing, at the computing device, the determined source identifier with at least one source identifier associated with the client; and signaling execution, at the computing device, of one or more client authentication challenges when the determined source identifier fails to match the at least one source identifier associated with the client. ### Claim 6 (depends on 5) The method of claim 5, further comprising associating, at the computing device, the determined source identifier with the client after successful execution of the one or more client authentication challenges. ### Claim 7 A method of client authentication, the method comprising: receiving, at a computing device, an Internet protocol source address of a client; extracting, at the computing device, a media access control address from the Internet protocol source address; comparing, at the computing device, the extracted media access control address with at least one client media access control address associated with the client; extracting, at the computing device, an organizationally unique identifier from the media access control address; determining, at the computing device, a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier; comparing, at the computing device, the determined source identifier with at least one source identifier associated with the client; signaling execution, at the computing device, of one or more client authentication challenges when: the extracted media access control address fails to match the at least one client media access control address associated with the client; or the determined source identifier fails to match the at least one source identifier associated with the client; associating, at the computing device, the determined source identifier with the client after successful execution of the one or more client authentication challenges; attributing, at the computing device, an age to the determined source identifier; and disassociating, at the computing device the determined source identifier from the client after a threshold period of time. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining, at the computing device a source device type from the media access control address; determining, at the computing device, a source software application type from the media access control address; comparing, at the computing device a compatibility between the determined source device type and the determined source software application type; and signaling execution, at the computing device, of one or more client authentication challenges when the determined source device type is incompatible with the determined source software application type. ### Claim 9 A security system comprising: a data processor executing: an extractor receiving an Internet protocol source address of a client and extracting a media access control address from the Internet protocol source address; a comparer comparing the extracted media access control address with at least one client media access control address associated with the client and signaling execution of one or more client authentication challenges when the extracted media access control address fails to match the at least one client media access control address associated with the client; and an attributer associating the extracted media access control address with the client after successful execution of the one or more client authentication challenges, the attributer disassociating the extracted media access control address from the client after a threshold period of time. ### Claim 10 (depends on 9) The security system of claim 9, wherein the extractor extracts an interface identifier from the Internet protocol source address and extracting the media access control address from the interface identifier. ### Claim 11 (depends on 9) The security system of claim 9, wherein the extractor extracts an organizationally unique identifier from the media access control address. ### Claim 12 (depends on 11) The security system of claim 11, wherein the extractor determines a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier. ### Claim 13 (depends on 12) The security system of claim 12, wherein the comparer: compares the determined source identifier with at least one source identifier associated with the client; and signals execution of one or more client authentication challenges when the determined source identifier fails to match the at least one source identifier associated with the client. ### Claim 14 (depends on 13) The security system of claim 13, wherein the attributer associates the determined source identifier with the client after successful execution of the one or more client authentication challenges. ### Claim 15 A security system comprising: a data processor executing: an extractor configured to: receive an Internet protocol source address of a client and extract a media access control address from the Internet protocol source address; and extract an organizationally unique identifier from the media access control address and determine a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier; a comparer configured to: compare the extracted media access control address with at least one client media access control address associated with the client; compare the determined source identifier with at least one source identifier associated with the client; and signal execution of one or more client authentication challenges when: the extracted media access control address fails to match the at least one client media access control address associated with the client; or the determined source identifier fails to match the at least one source identifier associated with the client; and an attributer configured to: associate the determined source identifier with the client after successful execution of the one or more client authentication challenges; and disassociate the determined source identifier from the client after a threshold period of time. ### Claim 16 (depends on 9) The security system of claim 9, wherein the extractor determines a source device type and a source software application type from the media access control address; and wherein the comparer compares a compatibility between the determined source device type and the determined source software application type and signals execution of one or more client authentication challenges when the determined source device type is incompatible with the determined source software application type. ### Claim 17 A computer program product encoded on a non-transitory computer readable storage medium comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising: receiving an Internet protocol source address of a client; extracting a media access control address from the Internet protocol source address; comparing the extracted media access control address with at least one client media access control address associated with the client; signaling execution of one or more client authentication challenges when the extracted media access control address fails to match the at least one client media access control address associated with the client; associating the extracted media access control address with the client after successful execution of the one or more client authentication challenges; attributing an age to the extracted media access control address; and disassociating the extracted media access control address from the client after a threshold period of time. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the performed operations further comprise: extracting an interface identifier from the Internet protocol source address; and extracting a media access control address from the interface identifier. ### Claim 19 (depends on 17) The computer program product of claim 17, wherein the performed operations further comprise extracting an organizationally unique identifier from the media access control address. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the performed operations further comprise determining a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier. ### Claim 21 (depends on 20) The computer program product of claim 20, wherein the performed operations further comprise: comparing the determined source identifier with at least one source identifier associated with the client; and signaling execution of one or more client authentication challenges when the determined source identifier fails to match the at least one source identifier associated with the client. ### Claim 22 (depends on 21) The computer program product of claim 21, wherein the performed operations further comprise associating the determined source identifier with the client after successful execution of the one or more client authentication challenges. ### Claim 23 A computer program product encoded on a non-transitory computer readable storage medium comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising: receiving an Internet protocol source address of a client; extracting a media access control address from the Internet protocol source address; comparing the extracted media access control address with at least one client media access control address associated with the client; extracting an organizationally unique identifier from the media access control address; determining a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier; comparing the determined source identifier with at least one source identifier associated with the client; signaling execution of one or more client authentication challenges when: the extracted media access control address fails to match the at least one client media access control address associated with the client; or the determined source identifier fails to match the at least one source identifier associated with the client; associating the determined source identifier with the client after successful execution of the one or more client authentication challenges; and disassociating the determined source identifier from the client after a threshold period of time. ### Claim 24 (depends on 17) The computer program product of claim 17, wherein the performed operations further comprise: determining a source device type from the media access control address; determining a source software application type from the media access control address; comparing a compatibility between the determined source device type and the determined source software application type; and signaling execution of one or more client authentication challenges when the determined source device type is incompatible with the determined source software application type.