# US 9,882,884 B1 · Authenticating mobile traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,884 B1 - Document ID: US9882884B1 - Status: Granted - Kind: B1 - Application number: 14/156,054 - Filed: 2014-01-15 - Granted: 2018-01-30 - Earliest claimed: 2014-01-15 - Assignees: United States Automobile Association (USAA) - Applicants: United Services Automobile Association (Usaa) - Inventors: Christopher Thomas Wilkinson; Gabriel Carlos Fernandez; Vicente Garcia; Gregory James McChesney; Matthew Thomas Murray; Rickey Dale Burks - Web page: https://patentgrep.com/patent/US9882884B1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1458: {Denial of Service} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and apparatus, including computer programs encoded on computer storage media, to authenticate mobile traffic. One of the methods includes receiving a first request for a strategy from a client device over a network. The method includes providing a current strategy to the client device, the current strategy including characteristics used to authenticate requests from the client device based on the inclusion of the characteristics in the request. The method includes receiving, from the client device, a second request for access to a processing system. The method includes validating the second request according to one or more strategies, including the current strategy. The method also includes forwarding the second request to the processing system based on the validation. ## Claims ### Claim 1 A computer-implemented method comprising: receiving a first request for a communication strategy file from a remote device associated with a network; transmitting to the remote device a current communication strategy file to the remote device, the current communication strategy file including: a name identifying a field to be added to the header of subsequent requests from the remote device, and a value to be at least one of placed in the field identified by the name and encrypted where the encrypted value is placed in the field identified by the name in the subsequent requests; receiving a second request for access to a processing system; authenticating the second request according to at least one communication strategy file, comprising: determining that a field in a header of the second request includes the field identified by the name, and determining whether the field in the header of the second request contains at least one of the value and the encrypted value; rejecting the request in response to determining the field in the header does not include at least one of the value and the encrypted value; and forwarding the second request to the processing system in response to determining that the field in the header includes at least one of the value and the encrypted value. ### Claim 2 (depends on 1) The method of claim 1, further comprising validating that a time identified by a time stamp included in the second request is within a threshold value of the current time. ### Claim 3 (depends on 1) The method of claim 1, wherein the second request includes the value encrypted using an encryption key stored securely on the remote device; and wherein authenticating the second request comprises: identifying an encrypted value stored in a field of the request, the field identified by the name; decrypting the encrypted value; and determining that the decrypted value is equal to the value. ### Claim 4 (depends on 1) The method of claim 1, wherein the communication strategy further includes a command. ### Claim 5 (depends on 4) The method of claim 4, wherein the command instructs the remote device to include a header that includes the value in a field identified by the name in subsequent communications. ### Claim 6 (depends on 4) The method of claim 4, wherein the command instructs the remote device to include a cookie that includes the value in a field identified by the name in subsequent communications. ### Claim 7 (depends on 1) The method of claim 1, further comprising: prior to receiving the first request, receiving a third request for access to the processing system, the third request omitting the characteristics; and in response to receiving the third request sending a rejection to the remote device, the rejection instructing the remote device to update the communication strategy. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving a server communication strategy file, the server communication strategy file including a new prior communication strategy, a new current communication strategy, and a new future communication strategy, the new prior communication strategy including first characteristics, the new current communication strategy including second characteristics, the new future communication strategy including third characteristics; and generating a file including the current communication strategy; wherein the first characteristics, the second characteristics, and the third characteristics are different; and wherein the first characteristics of the new prior communication strategy are the characteristics identified by the current communication strategy file. ### Claim 9 (depends on 1) The method of claim 1, wherein the at least one communication strategy includes a prior communication strategy, the prior communication strategy associated with an expiration time; and authenticating the second request according to at least one communication strategy comprises: determining the expiration time is after a current time, and comparing the prior communication strategy to the request including determining whether characteristics identified by the prior communication strategy are present in the request. ### Claim 10 (depends on 1) The method of claim 1, further comprising: providing an encryption key to the remote device, the encryption key encrypted using a second encryption key stored securely on the remote device. ### Claim 11 (depends on 1) The method of claim 1, wherein the at least one communication strategy file includes a first communication strategy file comprising a name identifying a field and a value identifying information to be placed in the field, and a second communication strategy file comprising a name identifying a field and a value identifying information to be placed in the field; and the name in first communication strategy file is different from the name in the second communication strategy file. ### Claim 12 A non-transitory computer storage medium encoded with computer program instructions that when executed by at least one computer cause the at least one computer to perform operations comprising: receiving a first request for a communication strategy from a remote device over a network; providing a current communication strategy file to the remote device, the current communication strategy file including: a name identifying a field to be added to the header of subsequent requests from the remote device, and a value to be at least one of placed in the field identified by the name and encrypted where the encrypted value is placed in the field identified by the name in the subsequent requests; receiving a second request for access to a processing system; authenticating the second request according to at least one communication strategy comprising determining that a field in a header of the second request includes the field identified by the name, and determining whether the field in the header of the second request contains at least one of the value and the encrypted value; rejecting the request in response to determining the field in the header does not include at least one of the value and the encrypted value; and forwarding the second request to the processing system in response to determining that the field in the header includes at least one of the value and the encrypted value. ### Claim 13 (depends on 12) The medium of claim 12, wherein the instructions further cause the at least one computer to perform operations comprising validating that a time identified by a time stamp included in the second request is within a threshold value of the current time. ### Claim 14 (depends on 12) The medium of claim 12, wherein the second request includes the value encrypted using an encryption key stored securely on the remote device; and wherein authenticating the second request comprises: identifying an encrypted value stored in a field of the request, the field identified by the name; decrypting the encrypted value; and determining that the decrypted value is equal to the value. ### Claim 15 (depends on 12) The medium of claim 12, wherein the communication strategy further includes a command. ### Claim 16 (depends on 15) The medium of claim 15, wherein the command instructs the remote device to include a header that includes the value in a field identified by the name in subsequent communications. ### Claim 17 (depends on 15) The medium of claim 15, wherein the command instructs the remote device to include a cookie that includes the value in a field identified by the name in subsequent communications. ### Claim 18 (depends on 12) The medium of claim 12, wherein the instructions further cause the at least one computer to perform operations comprising: prior to receiving the first request, receiving a third request for access to the processing system, the third request omitting the characteristics; and in response to receiving the third request sending a rejection to the remote device, the rejection instructing the remote device to update the communication strategy. ### Claim 19 (depends on 12) The medium of claim 12, wherein the instructions further cause the at least one computer to perform operations comprising: receiving a server communication strategy file, the server communication strategy file including a new prior communication strategy, a new current communication strategy, and a new future communication strategy, the new prior communication strategy including first characteristics, the new current communication strategy including second characteristics, the new future communication strategy including third characteristics; and generating a file including the current communication strategy; wherein the first characteristics, the second characteristics, and the third characteristics are different; and wherein the first characteristics of the new prior communication strategy are the characteristics identified by the current communication strategy file. ### Claim 20 (depends on 12) The medium of claim 12, wherein the-at least one strategy includes a prior communication strategy, the prior communication strategy associated with an expiration time; and authenticating the second request according to at least one strategy comprises: determining the expiration time is after a current time, and comparing the prior communication strategy to the request including determining whether characteristics identified by the prior communication strategy are present in the request. ### Claim 21 (depends on 12) The medium of claim 12, further comprising: providing an encryption key to the remote device, the encryption key encrypted using a second encryption key stored securely on the remote device. ### Claim 22 A system comprising: a communication strategy generator agent programmed to generate at least one communication strategy, the at least one communication strategy communication strategy including characteristics used to authenticate requests from device client devices based on the inclusion of the characteristics in the request; an authorization agent programmed to authenticate requests according to the at least one communication strategy; a processing agent programmed to: receive a first request for a communication strategy from a remote device over a network, transmit to the remote device a current communication strategy of the at least one communication strategy to the remote device, the current communication strategy including: a name identifying a field to be added to the header of subsequent requests from the remote device, and a value to be at least one of placed in the field identified by the name and encrypted where the encrypted value is placed in the field identified by the name in the subsequent requests, receive, from the remote device, a second request for access to a processing system, request authenticate of the second request from the authorization agent, the authentication comprising: determining that a field in a header of the second request includes the field identified by the name, and determining whether the field in the header of the second request contains at least one of the value and the encrypted value; rejecting the request in response to determining the field in the header does not include at least one of the value and the encrypted value; and forwarding the second request to the processing system in response to determining that the field in the header includes at least one of the value and the encrypted value; and a business processing system programmed to process the request. ### Claim 23 (depends on 22) The system of claim 22, wherein the processing agent is further programmed to validate that a time identified by a time stamp included in the second request is within a threshold value of the current time. ### Claim 24 (depends on 22) The system of claim 22, wherein the second request includes the value encrypted using an encryption key stored securely on the remote device; and wherein authenticating the second request comprises: identifying an encrypted value stored in a field of the request, the field identified by the name; decrypting the encrypted value; and determining that the decrypted value is equal to the value. ### Claim 25 (depends on 22) The system of claim 22, wherein the communication strategy further includes a command. ### Claim 26 (depends on 25) The system of claim 25, wherein the command instructs the remote device to include a header that includes the value in a field identified by the name in subsequent communications. ### Claim 27 (depends on 25) The system of claim 25, wherein the command instructs the remote device to include a cookie that includes the value in a field identified by the name in subsequent communications. ### Claim 28 (depends on 22) The system of claim 22, wherein the processing agent is further programmed to receive a third request for access to the processing system prior to receiving the first request, the third request omitting the characteristics; and in response to receiving the third request, send a rejection to the remote device, the rejection instructing the remote device to update the communication strategy. ### Claim 29 (depends on 22) The system of claim 22, wherein the communication strategy generator agent is further programmed to: receive a server communication strategy file, the server communication strategy file including a new prior communication strategy, a new current communication strategy, and a new future communication strategy, the new prior communication strategy including first characteristics, the new current communication strategy including second characteristics, the new future communication strategy including third characteristics; and generate a file including the current communication strategy; wherein the first characteristics, the second characteristics, and the third characteristics are different; and wherein the first characteristics of the new prior communication strategy are the characteristics identified by the current communication strategy file. ### Claim 30 (depends on 22) The system of claim 22, wherein the at least one strategy includes a prior communication strategy, the prior communication strategy associated with an expiration time; and authenticating the second request according to the at least one strategy comprises: determining the expiration time is after a current time, and comparing the prior communication strategy to the request including determining whether characteristics identified by the prior communication strategy are present in the request. ### Claim 31 (depends on 22) The system of claim 22, further comprising an encryption agent programmed to provide an encryption key to the remote device, the encryption key encrypted using a second encryption key stored securely on the remote device.