# US 8,789,158 B2 · Using clock drift, clock slew, and network latency to enhance machine identification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,158 B2
- Document ID: US8789158B2
- Status: Granted
- Kind: B2
- Application number: 13/397,070
- Filed: 2012-02-15
- Published: 2012-08-23
- Granted: 2014-07-22
- Earliest claimed: 2011-02-17
- Assignees: eBay Inc.
- Applicants: Rasta A. Mansour; Upendra Mardikar
- Inventors: Rasta A. Mansour; Upendra Mardikar
- Web page: https://patentgrep.com/patent/US8789158B2

## CPC

- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/44: Program or device authentication
- G06F 21/725: {operating on a secure reference time value}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- H04L 43/0858: {One way delays}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 67/52: specially adapted for the location of the user terminal
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2129: Authenticate client device independently of the user
- G06F 2221/2151: Time stamp
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/3255: {using mobile network messaging services for payment, e.g. SMS}
- G06Q 20/3278: {RFID or NFC payments by means of M-devices}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods and systems for authenticating a user device employ a database of global network latencies categorized and searchable by location and calendar date-time of day usage, providing network latency by geography and by time. The database is constructed using voluminous daily data collected from a world-wide clientele of users who sign in to a particular website. Accuracy of the latency data and clock skew machine identification is made practical and useful for authentications using a service provider-proprietary, stable reference clock, such as an atomic clock, so that internal clock jitter of a service provider performing authentications does not affect the network latency time and clock skew identification of user devices. Increased authentication confidence results from using the database for correcting network latency times and user device signatures generated from the clock skew identifications and for cross checking the authentication using comparisons of initial registration to current sign in data.

## Claims

### Claim 1

A system comprising:
a server in communication with a user device via a network;
a reference clock in communication with the server for providing accurate time signals to the server; and
a database accessible to the server and providing:
network latencies for the network relative to the server mapped by geography and scheduling aspects including scheduling aspects for the network and scheduling aspects for the user device; and
user device signatures mapped to user identities;
wherein the server comprises a processor and a data storage device including computer readable code for instructing the processor that, when executed by the processor, causes the processor to perform operations for:
mapping geography and scheduling information collected from a plurality of user devices to user identities in the database;
comparing a current network latency from the user device to the network latencies mapped in the database by geography and to the geography information mapped to a user identity, wherein the user identity is determined from a user identity material;
authenticating the user device by a network latency and a clock skew signature from the user device, the authentication using the user device signatures, the user identities, the database mapping of user device signatures to user identities, and the network latencies for the network relative to the server mapped by geography and the scheduling aspects for the network and the scheduling aspects for the user device; and
increasing confidence in the authentication if the current network latency from the location of the user device accords with the network latency for the location mapped in the database by geography and the location accords with the geography information mapped in the database to the user identity.

### Claim 2 (depends on 1)

The system of claim 1, wherein the server further includes computer readable code for instructing the processor that, when executed by the processor, causes the processor to perform operations for generating a user device signature of the user device, including:
sampling a clock skew of the user device;
measuring a network latency of the user device relative to the server; and
generating the user device signature by compensating the clock skew samples using the network latency measurement and using the database mappings for network latencies by geography and scheduling aspects.

### Claim 3 (depends on 1)

The system of claim 1, wherein the server further includes computer readable code for instructing the processor that, when executed by the processor, causes the processor to perform operations for:
generating an initial user device signature using a clock skew sample and an initial network latency compensation corrected for geography and scheduling aspects; and
mapping the initial user device signature to a user identity in the database.

### Claim 4 (depends on 1)

The system of claim 1, wherein the server further includes computer readable code for instructing the processor that, when executed by the processor, causes the processor to perform operations for:
generating a current user device signature using a current clock skew sample and a current network latency compensation corrected for current geography and scheduling aspects;
finding an initial user device signature corresponding, under the database mapping of user device signatures to user identities, to a user identity determined from a user identity material; and
comparing the initial user device signature to the current user device signature.

### Claim 5 (depends on 1)

The system of claim 1, wherein the mapping of user device signatures to user identities in the database includes:
a user registration including:
user identity material presented via the user device;
a user device signature generated from a clock skew and latency sampling; and
a user identity in the database including:
a mapping of the identity material to the user identity; and
a mapping of the user device signature to the user identity.

### Claim 6 (depends on 1)

The system of claim 1, wherein the server further includes computer readable code for instructing the processor that, when executed by the processor, causes the processor to perform operations for:
comparing a current network latency from the user device to the network latencies mapped in the database by geography; and
increasing confidence in the authentication if the current network latency from the location of the user device accords with the network latency for the location mapped in the database.

### Claim 7

A method for authenticating a user device acting as a client and communicating with a server via a network, the method comprising:
building a database of user device signatures and network latencies relative to the server, wherein:
the user device signatures are mapped in the database to user identities;
the network latencies are mapped in the database by geography; and
the network latencies are mapped in the database by scheduling aspects including scheduling aspects for the network and scheduling aspects for the user device;
initially authenticating the user device by presentation of user identity material, wherein the user identity material is sufficient to determine a user identity in the database;
mapping geography and scheduling information collected from user devices to user identities in the database;
comparing the current network latency from the user device to the network latencies mapped in the database by geography and to the geography information mapped to the user identity determined from the user identity material;
authenticating the user device by a current network latency and a current user device signature from the user device, wherein the authentication uses the user device signatures, the user identity determined from the user identity material, the database mapping of user device signatures to user identities, and the network latencies for the network relative to the server mapped by geography and the scheduling aspects for the network and the scheduling aspects for the user device; and
increasing a confidence in the authentication if the current network latency from the location of the user device accords with the network latency for the location mapped in the database by geography and the location accords with the geography information mapped in the database to the user identity.

### Claim 8 (depends on 7)

The method of claim 7, further comprising generating a user device signature of the user device, including:
sampling a clock skew of the user device;
measuring a network latency of the user device relative to the server; and
generating the user device signature by compensating the clock skew samples using the network latency measurement and using the database mappings for network latencies by geography and scheduling aspects.

### Claim 9 (depends on 7)

The method of claim 7, wherein authenticating the user device by a network latency and a user device signature from the user device comprises:
generating an initial user device signature using a clock skew sample and an initial network latency compensation corrected for geography and scheduling aspects; and
mapping the initial user device signature to a user identity in the database.

### Claim 10 (depends on 7)

The method of claim 7, wherein authenticating the user device by a network latency and a user device signature from the user device comprises:
generating the current user device signature using a current clock skew sample and a current network latency compensation corrected for current geography and scheduling aspects;
finding an initial user device signature corresponding, under the database mapping of user device signatures to user identities, to the user identity determined from the user identity material; and
comparing the initial user device signature to the current user device signature.

### Claim 11 (depends on 7)

The method of claim 7, wherein mapping the user device signatures to user identities in the database comprises:
registering a user by:
accepting the user identity material presented via the user device;
generating a user device signature from a clock skew and latency sampling; and
generating a user identity in the database by:
mapping the identity material to the user identity; and
mapping the user device signature to the user identity.

### Claim 12 (depends on 7)

The method of claim 7, wherein the authenticating further comprises:
comparing the current network latency from the user device to the network latencies mapped in the database by geography; and
increasing confidence in the authentication if the current network latency from the location of the user device accords with the network latency for the location mapped in the database.

### Claim 13

A computer program product comprising a non-transitory computer readable medium having computer readable and executable code for instructing a processor to perform a method, the method comprising:
building a database of user device signatures and network latencies relative to the server, wherein:
the user device signatures are mapped in the database to user identities;
the network latencies are mapped in the database by geography; and
the network latencies are mapped in the database by scheduling aspects including scheduling aspects for the network and scheduling aspects for the user device;
initially authenticating the user device by presentation of user identity material, wherein the user identity material is sufficient to determine a user identity in the database;
mapping geography and scheduling information collected from user devices to user identities in the database;
comparing the current network latency from the user device to the network latencies mapped in the database by geography and to the geography information mapped to the user identity determined from the user identity material;
authenticating the user device by a current network latency and a current user device signature from the user device, wherein the authentication uses the user device signatures, the user identity determined from the user identity material, the database mapping of user device signatures to user identities, and the network latencies for the network relative to the server mapped by geography and the scheduling aspects for the network and the scheduling aspects for the user device; and
increasing confidence in the authentication if the current network latency from the location of the user device accords with the network latency for the location mapped in the database by geography and the location accords with the geography information mapped in the database to the user identity.

### Claim 14 (depends on 13)

The computer program product of claim 13, the method further comprising generating a user device signature of the user device, including:
sampling a clock skew of the user device;
measuring a network latency of the user device relative to the server; and
generating the user device signature by compensating the clock skew samples using the network latency measurement and using the database mappings for network latencies by geography and scheduling aspects.

### Claim 15 (depends on 13)

The computer program product of claim 13, wherein authenticating the user device by a network latency and a user device signature from the user device comprises:
generating an initial user device signature using a clock skew sample and an initial network latency compensation corrected for geography and scheduling aspects; and
mapping the initial user device signature to a user identity in the database.

### Claim 16 (depends on 13)

The computer program product of claim 13, wherein authenticating the user device by a network latency and a user device signature from the user device comprises:
generating the current user device signature using a current clock skew sample and a current network latency compensation corrected for current geography and scheduling aspects;
finding an initial user device signature corresponding, under the database mapping of user device signatures to user identities, to the user identity determined from the user identity material; and
comparing the initial user device signature to the current user device signature.

### Claim 17 (depends on 13)

The computer program product of claim 13, wherein mapping the user device signatures to user identities in the database comprises:
registering a user by:
accepting the user identity material presented via the user device;
generating a user device signature from a clock skew and latency sampling; and
generating a user identity in the database by:
mapping the identity material to the user identity; and
mapping the user device signature to the user identity.

### Claim 18 (depends on 13)

The computer program product of claim 13, wherein the authenticating further comprises:
comparing the current network latency from the user device to the network latencies mapped in the database by geography; and
increasing confidence in the authentication if the current network latency from the location of the user device accords with the network latency for the location mapped in the database.