# US 9,438,575 B2 · Smart phone login using QR code

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,575 B2
- Document ID: US9438575B2
- Status: Granted
- Kind: B2
- Application number: 13/713,219
- Filed: 2012-12-13
- Published: 2013-06-27
- Granted: 2016-09-06
- Earliest claimed: 2011-12-22
- Assignees: Paypal, Inc.
- Applicants: Paypal, Inc.
- Inventors: Jiazheng Shi
- Web page: https://patentgrep.com/patent/US9438575B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04W 12/06: Authentication
- H04W 12/77: Graphical identity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods are disclosed for a user to use a mobile device such as a smart phone to scan a QR (Quick Response) code displayed on a login webpage of a website. The QR code may encode a server URL of the website. The mobile device decodes the QR code and transmits a device ID and other decoded information to a service provider. The service provider locates login credentials of the user linked to the device ID and communicates the login credentials to a website server for user authentication. Alternatively, the mobile device may transmit its device ID to the website server for the website server to locate a user account linked to the device ID for user login. Alternatively, the mobile device may transmit stored login credentials to the website server. Advantageously, a user may access a website without the need to provide any login credentials.

## Claims

### Claim 1

A system for a service provider comprising:
a network interface configured to communicate with devices over a network;
a non-transitory memory configured to store a plurality of machine-readable instructions; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving a login request from a user through a user device comprising at least a device identifier (ID) and a user name for an account, wherein the login request is received from a scan of a code on a login page of a website using a camera of the user device, wherein the user device executes a mobile application to scan the code using the camera, and wherein the mobile application captures and decodes the code to transmit the login request with the device ID encrypted by the mobile application;
decrypting the device ID;
determining from the login request the account associated with the website using the user name;
in response to determining that the account is not associated with the device ID, requesting a password from the user for the account;
in response to validating that the password corresponds to the account, causing the user to be granted access to the website using the user name and the password of the account;
storing the device ID with the user name and the password for the account by the service provider;
receiving, from the mobile application of the user device, at least one subsequent login from at least one subsequent scan of at least one additional code displayed on the login page of the website using the camera of the user device with the device ID for the user device;
determining the website from the at least one additional code;
determining the account for the website using the device ID and the determining the website from the at least one additional code; and
communicating the user name and the password to the website for access to the account by the user during the at least one subsequent login, wherein the website transmits a login confirmation webpage to the user device to access to the account with the website.

### Claim 2 (depends on 1)

The system of claim 1, wherein the code comprises a server URL for the website.

### Claim 3 (depends on 1)

The system of claim 1, wherein the login request further comprises information encoded in the code.

### Claim 4 (depends on 1)

The system of claim 1, wherein the one or more hardware processors are further configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
storing login credentials for accounts linked to the user device for a plurality of websites.

### Claim 5 (depends on 1)

The system of claim 1, wherein the login request comprises login credentials of the user, and wherein the requesting the password from the user comprises accessing the password from the login credentials.

### Claim 6 (depends on 1)

The system of claim 1, wherein the login request is received when the user scans the code after opening the mobile application on the user device.

### Claim 7 (depends on 1)

The system of claim 1, wherein the code is a two-dimensional QR code.

### Claim 8

A method comprising:
receiving by a processor of a server a login request from a user through a user device comprising at least a device identifier (ID) and a user name for an account, wherein the login request is received from a scan of a code on a login page of a website using a camera of the user device, wherein the user device executes a mobile application to scan the code using the camera, and wherein the mobile application captures and decodes the code to transmit the login request with the device ID encrypted by the mobile application;
decrypting the device ID;
determining from the login request the account associated with the website using the user name;
in response to determining that the account is not associated with the device ID, requesting a password from the user for the account;
in response to validating that the password corresponds to the account, granting access to the website using the user name and the password of the account;
storing the device ID with the user name and the password for the account by the service provider;
receiving, from the mobile application of the user device, at least one subsequent login from at least one subsequent scan of at least one additional code displayed on the login page of the website using the camera of the user device with the device ID for the user device;
determining the website from the at least one additional code;
determining the account for the website using the device ID and the determining the website from the at least one additional code; and
communicating the user name and the password to the website for access to the account by the user during the at least one subsequent login, wherein the website transmits a login confirmation webpage to the user device to access to the account with the website.

### Claim 9 (depends on 8)

The method of claim 8, wherein the code comprises a server URL for the website.

### Claim 10 (depends on 8)

The method of claim 8, wherein the login request further comprises information encoded in the code.

### Claim 11 (depends on 8)

The method of claim 8, further comprising storing login credentials for accounts linked to the user device for a plurality of websites.

### Claim 12 (depends on 8)

The method of claim 8, wherein the login request comprises login credentials of the user, and wherein the requesting the password from the user comprises accessing the password from the login credentials.

### Claim 13 (depends on 8)

The method of claim 8, wherein the code is a two-dimensional QR code.

### Claim 14

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving by a processor of a server a login request from a user through a user device comprising at least a device identifier (ID) and a user name for an account, wherein the login request is received from a scan of a code on a login page of a website using a camera of the user device, wherein the user device executes a mobile application to scan the code using the camera, and wherein the mobile application captures and decodes the code to transmit the login request with the device ID encrypted by the mobile application;
decrypting the device ID;
determining from the login request account associated with the website using the user name;
in response to determining that the account is not associated with the device ID, requesting a password from the user for the account;
in response to validating that the password corresponds to the account, granting access to the website using the user name and the password of the account;
storing the device ID with the user name and the password for the account by the service provider;
receiving, from the mobile application of the user device, at least one subsequent login from at least one subsequent scan of at least one additional code displayed on the login page of the website using the camera of the user device with the device ID for the user device;
determining the website from the at least one additional code;
determining the account for the website using the device ID and the determining the website from the at least one additional code; and
communicating the user name and the password to the website for access to the account by the user during the at least one subsequent login, wherein the website transmits a login confirmation webpage to the user device to access to the account with the website.