User authentication based on periodic sampling of location coordinates

Abstract

According to one embodiment, a method, computer system and computer program product for user authentication. The embodiment may include receiving, from a first device, a plurality of position coordinates of the first device. The embodiment may include storing, on a second device, a second moving window including the last n position coordinates of the plurality of position coordinates. The embodiment may include receiving, from a first device, a request to access a second device, where the request includes a login credential and a first hash value. The embodiment may include calculating, on the second device, a second hash value based on the second moving window. The embodiment may include verifying the login credential. The embodiment may include comparing the first hash value and the second hash value. In response to the first hash value and the second hash value being equal and the login credential being verified, the embodiment may include granting access.

Description

Background Art

[0001] The present invention relates generally to the field of computing, and more particularly to multi-factor authentication of users.

[0002] User authentication verifies the identity of a user requesting access to a computing system by authorizing the human-machine transmission of credentials during interactions on the network to confirm the authenticity of the user. Authentication helps ensure that only authorized users gain access to a network or computing system (i.e., log in) by preventing unauthorized users from gaining access to the network or computing system. Categories of factors (i.e., evidence) used in user authentication may include knowledge factors, possession factors, and inherent factors. Knowledge factors may include things that a user must know in order to log in to a network or computing system (e.g., username, user ID, password, personal identification number). Possession factors may include things that a user must have in order to complete the login (e.g., one-time password (OTP), key fob, smartphone application, employee ID card). Intrinsic factors may include features inherent to the user that confirm their identity (e.g., biometrics, facial recognition, voice authentication). Multi-factor authentication (MFA) is an electronic authentication method in which a user is granted access only after successfully presenting factors from two or more categories to the authentication mechanism. For example, in order to log in to a computing system, a user may be required to provide a user ID and password combined with an OTP. Summary of the invention

[0003] According to one embodiment, a method, computer system, and computer program product for user authentication are provided. The embodiment may include receiving multiple location coordinates of a first device from a first device. The embodiment may include storing a second moving window including the last n location coordinates of the multiple location coordinates on a second device. The embodiment may include receiving a request to access a second device from a first device, wherein the request includes a user's login credentials and a first hash value. The embodiment may include calculating a second hash value based on a set of the last n location coordinates of the second moving window on the second device. The embodiment may include verifying the user's login credentials. The embodiment may include comparing the first hash value and the second hash value. In response to the first hash value and the second hash value being equal and the login credentials being verified, the embodiment may include granting access to the second device via the first device.

[0004] According to one aspect, a computer-implemented method is provided, the method comprising: receiving multiple location coordinates of a first device from a first device; storing a second moving window including the last n location coordinates of the multiple location coordinates on a second device; receiving a request to access the second device from the first device, wherein the request includes a user's login credentials and a first hash value; on the second device, calculating a second hash value based on a set of the last n location coordinates of the second moving window; verifying the user's login credentials; comparing the first hash value and the second hash value; and in response to the first hash value and the second hash value being equal and the login credentials being verified, allowing access to the second device via the first device.

[0005] According to another aspect, a computer system is provided, which includes: one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one tangible storage medium in the one or more tangible storage media, the program instructions being used to be executed by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of executing a method, the method comprising: receiving a plurality of location coordinates of a first device from a first device; storing a second moving window including the last n location coordinates of the plurality of location coordinates on a second device; receiving a request to access the second device from the first device, wherein the request includes a user's login credentials and a first hash value; on the second device, calculating a second hash value based on a set of the last n location coordinates of the second moving window; verifying the user's login credentials; comparing the first hash value and the second hash value; and in response to the first hash value and the second hash value being equal and the login credentials being verified, permitting access to the second device via the first device.

[0006] According to another aspect, a computer program product is provided, which includes: one or more computer-readable tangible storage media and program instructions stored on at least one tangible storage medium among the one or more tangible storage media, wherein the program instructions can be executed by a processor capable of executing a method, the method including: receiving multiple location coordinates of a first device from a first device; storing a second moving window including the last n location coordinates of the multiple location coordinates on a second device; receiving a request to access the second device from the first device, wherein the request includes a user's login credentials and a first hash value; on the second device, calculating a second hash value based on a set of the last n location coordinates of the second moving window; verifying the user's login credentials; comparing the first hash value and the second hash value; and in response to the first hash value and the second hash value being equal and the login credentials being verified, allowing access to the second device via the first device. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Preferred embodiments of the present invention will now be described, by way of example only, and with reference to the following drawings:

[0008] Figure 1 An exemplary computer environment in accordance with at least one embodiment is shown.

[0009] Figure 2 An operational flow diagram for authenticating a user via a location sampling multi-factor authentication process in accordance with at least one embodiment is shown.

[0010] The various features of the drawings are not to scale, as they are illustrated for clarity in order to assist those skilled in the art in understanding the invention in conjunction with the detailed description. DETAILED DESCRIPTION

[0011] Detailed embodiments of the claimed structures and methods are disclosed herein; however, it is understood that the disclosed embodiments are merely illustrative of the claimed structures and methods that may be implemented in various forms. However, the present invention may be implemented in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. In the description, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments.

[0012] It should be understood that the singular forms "a", "an", and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a component surface" includes reference to one or more of such surfaces unless the context clearly dictates otherwise.

[0013] The present invention relates generally to the field of computing, and more particularly to multi-factor authentication of users. The exemplary embodiments described below provide a system, method, and program product for authenticating a user via, among other things, a received hash value of sampled (i.e., identified) location coordinates of a registered computing device that is co-located with the user and a received login credentials (e.g., user ID and password) of the user. Thus, the present embodiments have the ability to improve the technical field of multi-factor authentication by authenticating a user based in part on a dynamically calculated hash value of a set of the user's identified location coordinates, which is sent to an authentication server along with the user's login credentials, thereby eliminating multiple round-trip communications between the user and the authentication server.

[0014] As previously described, user authentication verifies the identity of a user requesting access to a computing system by authorizing the human-machine transmission of credentials during interactions on the network to confirm the authenticity of the user. Authentication helps ensure that only authorized users gain access to a network or computing system (i.e., log in) by preventing unauthorized users from gaining access to the network or computing system. The categories of factors (i.e., evidence) used in user authentication may include knowledge factors, possession factors, and inherent factors. Knowledge factors may include things that a user must know in order to log in to a network or computing system (e.g., username, user ID, password, personal identification number). Possession factors may include things that a user must have in order to complete the login (e.g., one-time password (OTP), key card, smartphone application, employee ID card). Intrinsic factors may include features inherent to the user that confirm their identity (e.g., biometrics, facial recognition, voice authentication). MFA is an electronic authentication method in which a user is granted access only after successfully presenting factors from two or more categories to the authentication mechanism. For example, in order to log in to a computing system, a user may be required to provide a user ID and password combined with an OTP.

[0015] OTP is a password that is valid for only one login session or transaction on a computer system or other digital device. Because OTP works through a random algorithm that generates a new and random password each time it is used, OTP can provide more enhanced protection than static passwords, which remain the same for multiple login sessions. OTP generation can utilize several technologies, including time synchronization and mathematical algorithm schemes. OTP mechanisms that enhance authentication are widely used, however, it is time-consuming because multiple round-trip communications between the user and the authentication server are required before access is granted. For example, a first round-trip communication between a user and an authentication server may include a user sending a user ID and password to the authentication server via a client device, and in response, receiving an OTP from the authentication server. Subsequently, a second round-trip communication between the user and the authentication server may include a user sending an OTP back to the authentication server via a client device, and in response, receiving verification / access from the authentication server. These multiple round-trip communications between the user and the authentication server may delay the user while the user is waiting to receive the OTP, and may therefore reduce the user's productivity. In addition, the OTP mechanism may have the additional disadvantage of preventing users from accessing certain resources when they are needed in real time. Therefore, it may be necessary to set up a system to provide MFA using information related to the identified location coordinates of the user, which is sent along with the user's user ID and password for authentication. Therefore, embodiments of the present invention may be advantageous for, among other things, calculating a hash value of the identified location coordinates of a computing device co-located with a user, authenticating the user using the calculated hash value in conjunction with the user's user ID and password, and eliminating the need for a second round-trip communication for MFA for the user. The present invention does not require that all advantages need to be incorporated into every embodiment of the present invention.

[0016] According to at least one embodiment, a user may register a global positioning system (GPS) enabled electronic device (e.g., a smart phone) to an authentication server. The registered device may periodically identify its location coordinates and share them with the authentication server. A moving window of location coordinates (e.g., the last n identified location coordinates) may be maintained on the registered device and the authentication server. When a user requests access to the authentication server via a registered device, the user's login credentials (e.g., user ID and password) and a hash value calculated by the registered device for a set of location coordinates of the moving window may be sent to the authentication server for authentication. The user may be granted access to the authentication server, wherein the authentication has determined a match between a valid login credential and a hash value calculated by the registered device for a set of location coordinates of the moving window and a hash value calculated by the authentication server. According to at least one embodiment, the frequency of location coordinate identification, the number of location coordinates stored in the moving window, and the hash algorithm applied may be defined during the system initialization phase and implemented by both the registered device and the authentication server. According to at least one other embodiment, access to the authentication server may be based in part on a comparison of the identified location coordinates of the registered device maintained on the registered device with the identified location coordinates of the registered device maintained on the authentication server. According to at least one other embodiment, an OTP may be additionally utilized for verification, wherein there is no change among the last n identified location coordinates of the registered device.

[0017] Various aspects of the present disclosure are described by narrative text, flow charts, block diagrams of computer systems, and / or block diagrams of machine logic included in computer program product (CPP) embodiments. With respect to any flow chart, depending on the technology involved, the operations may be performed in an order different from the order shown in a given flow chart. For example, again depending on the technology involved, two operations shown in consecutive flow chart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in a manner that at least partially overlaps in time.

[0018] Computer program product embodiments ("CPP embodiments" or "CPP") are terms used in this disclosure to describe any collection of one or more storage media (also referred to as "media") collectively included in a collection of one or more storage devices that collectively include machine-readable code corresponding to instructions and / or data for performing the computer operations specified in a given CPP claim. A "storage device" is any tangible device that can hold and store instructions for use by a computer processor. Without limitation, a computer-readable storage medium may be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include: magnetic disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanical encoding devices (such as punch cards or pits / land formed in a major surface of a disk), or any suitable combination of the foregoing. As the term is used in this disclosure, computer-readable storage media should not be interpreted as storing in the form of transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, light pulses transmitted through fiber optic cables, electrical signals transmitted through wires, and / or other transmission media. As will be appreciated by those skilled in the art, data is typically moved at certain occasional points in time during normal operation of the storage device, such as during access, defragmentation, or garbage collection, but this does not make the storage device transient because the data is not transient when it is stored.

[0019] The exemplary embodiments described below provide a system, method, and program product for authenticating a user based in part on information related to a set of identified location coordinates of electronic devices that are co-located with the user, and accordingly, in response to successful authentication, granting the user access to a computing system and / or applications of the computing system.

[0020] refer to Figure 1 , depicts an exemplary computing environment 100 according to at least one embodiment. The computing environment 100 includes an example of an environment for executing at least some of the computer code involved in performing the methods of the present invention, such as authentication programs 107A, 107B. The authentication programs 107A, 107B may be programs capable of granting a user access to a computing system based on authentication of data related to the location coordinates of the user that are periodically identified. In at least one embodiment, the authentication programs 107A, 107B may require the user to opt-in to system use when opening or installing the authentication programs 107A, 107B. Reference will be made to Figure 2 The authentication method is explained in more detail. In addition to the authentication program 107A, 107B, the computing environment 100 includes, for example, a computer 101, a wide area network (WAN) 102, an end-user device (EUD) 103, a remote server 104, a public cloud 105, and a private cloud 106. In this embodiment, the computer 101 includes a processor group 110 (including a processing circuit 120 and a cache 121), a communication structure 111, a volatile memory 112, a permanent storage device 113 (including an operating system 122, a software program 108, and an authentication program 107A, 107B), a peripheral device group 114 (including a user interface (UI) device group 123, a storage device 124, and an Internet of Things (IoT) sensor group 125) and a network module 115. The remote server 104 includes a remote database 130. The public cloud 105 includes a gateway 140, a cloud orchestration module 141, a host physical machine group 142, a virtual machine group 143, and a container group 144. Although depicted in a computer 101 and an end-user device 103, the authentication programs 107A, 107B may be stored in and / or executed by the end-user device 103, a remote server 104, a public cloud 105, and a private cloud 106, individually or in any combination, such that functionality may be separated between devices.

[0021] Computer 101 may take the form of a desktop computer, a laptop computer, a tablet computer, a smart phone, a smart watch or other wearable computer, a mainframe computer, a quantum computer, or any other form of computer or mobile device now known or developed in the future that is capable of running programs, accessing a network, or querying a database such as remote database 130. As is well known in the art of computer technology, and depending on the technology, execution of computer-implemented methods may be distributed among multiple computers and / or among multiple locations. On the other hand, in this presentation of computing environment 100, the detailed discussion focuses on a single computer, particularly computer 101, to keep the presentation as simple as possible. Computer 101 may be located in the cloud, even though the computer 101 is located in the cloud. Figure 1 On the other hand, computer 101 need not be in the cloud except to any extent that can be positively indicated.

[0022] Processor group 110 includes one or more computer processors of any type known now or to be developed in the future. Processing circuit 120 can be distributed over multiple packages, such as multiple coordinated integrated circuit chips. Processing circuit 120 can implement multiple processor threads and / or multiple processor cores. Cache 121 is a memory located in the processor chip package, and is generally used for data or code that should be quickly accessed by threads or cores running on processor group 110. Cache memory is generally organized into multiple levels according to relative proximity to the processing circuit. Alternatively, some or all of the caches of the processor group may be located "off chip". In some computing environments, processor group 110 may be designed to work with quantum bits and perform quantum computing.

[0023] Computer-readable program instructions are typically loaded onto the computer 101 so that a series of operating steps are performed by the processor group 110 of the computer 101, and thereby a computer-implemented method is implemented, so that the instructions so executed will instantiate the method specified in the flowchart and / or narrative description of the computer-implemented method included in this document (collectively referred to as the "method of the present invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 121 and other storage media discussed below. The program instructions and associated data are accessed by the processor group 110 to control and direct the execution of the method of the present invention. In the computing environment 100, at least some of the instructions for executing the method of the present invention can be stored in the permanent storage device 113 and the authentication program 107A, 107B in the end-user device 103, respectively.

[0024] Communications fabric 111 is the signaling pathways that allow the various components of computer 101 to communicate with each other. Typically, the fabric is comprised of switches and conductive pathways, such as those that make up a bus, a bridge, physical input / output ports, etc. Other types of signal communication pathways may be used, such as fiber optic communication pathways and / or wireless communication pathways.

[0025] The volatile memory 112 is any type of volatile memory now known or to be developed in the future. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory is characterized by random access, but this is not required unless expressly indicated. In the computer 101, the volatile memory 112 is located in a single package and is internal to the computer 101, but, alternatively or additionally, the volatile memory can be distributed in multiple packages and / or located externally relative to the computer 101.

[0026] Permanent storage 113 is any form of non-volatile storage for computers known now or to be developed in the future. The non-volatility of the storage means that the stored data is maintained regardless of whether power is supplied to the computer 101 and / or directly to the permanent storage 113. Permanent storage 113 may be a read-only memory (ROM), but typically at least a portion of the permanent storage allows writing of data, deletion of data, and rewriting of data. Some common forms of permanent storage include disks and solid-state storage devices. Operating system 122 may take several forms, such as various known proprietary operating systems or operating systems of the type of open source portable operating system interface using a kernel. The code included in authentication programs 107A, 107B typically includes at least some of the computer codes involved in performing the method of the present invention.

[0027] The peripheral device group 114 includes a group of peripheral devices of the computer 101. The data communication connection between the other components of the computer 101 and the peripheral devices can be implemented in various ways, such as a Bluetooth connection, a near field communication (NFC) connection, a connection through a cable (such as a universal serial bus (USB) type cable), a plug-in type connection (e.g., a secure digital (SD) card), a connection through a local area communication network, and even a connection through a wide area network such as the Internet. In various embodiments, the UI device group 123 may include components such as a display screen, a speaker, a microphone, a wearable device (such as smart glasses and smart watches), a keyboard, a mouse, a printer, a touchpad, a game controller, and a tactile device. The storage device 124 is an external storage device, such as an external hard drive, or a pluggable storage device, such as an SD card. The storage device 124 can be permanent and / or volatile. In some embodiments, the storage device 124 can take the form of a quantum computing storage device for storing data in the form of quantum bits. In embodiments where the computer 101 needs to have a large amount of storage (e.g., where the computer 101 locally stores and manages a large database), the storage may be provided by a peripheral storage device designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. The IoT sensor group 125 is composed of sensors that can be used in IoT applications. For example, one sensor may be a thermometer, another sensor may be a motion detector, and yet another sensor may be a GPS receiver that provides satellite navigation and geolocation capabilities for the computer 101.

[0028] The network module 115 is a collection of computer software, hardware, and firmware that allows the computer 101 to communicate with other computers via the WAN 102. The network module 115 may include hardware such as a modem or a Wi-Fi signal transceiver, software for packetizing and / or depacketizing data transmitted over a communication network, and / or a web browser software for transmitting data over the Internet. In some embodiments, the network control function and the network forwarding function of the network module 115 are executed on the same physical hardware device. In other embodiments (e.g., embodiments utilizing software defined networks (SDN)), the control function and the forwarding function of the network module 115 are executed on physically separated devices so that the control function manages several different network hardware devices. Computer-readable program instructions for executing the method of the present invention can typically be downloaded to the computer 101 from an external computer or an external storage device via a network adapter card or a network interface included in the network module 115.

[0029] WAN 102 is any wide area network (e.g., the Internet) capable of transmitting computer data over non-local distances by any technology now known or to be developed in the future for transmitting computer data. In some embodiments, the WAN may be replaced and / or supplemented by a local area network (LAN) designed to transmit data between devices located in a local area, such as a Wi-Fi network. A WAN and / or LAN typically includes computer hardware, such as copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, and edge servers.

[0030] An end-user device (EUD) 103 is any computer system used and controlled by an end-user (e.g., a customer of an enterprise operating computer 101), and may take any form discussed above in conjunction with computer 101. According to embodiments of the present invention, EUD 103 may be capable of hosting and running authentication program 107B, and communicating with computer 101 via WAN 102. EUD 103 typically receives helpful and useful data from the operation of computer 101. For example, in the hypothetical case where computer 101 is designed to provide recommendations to an end-user, the recommendation would typically be transmitted to EUD 103 from network module 115 of computer 101 via WAN 102. In this way, EUD 103 may display or otherwise present the recommendation to the end-user. In some embodiments, EUD 103 may be a client device, such as a thin client, a heavy client, a mainframe computer, a desktop computer, or the like.

[0031] Remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. Remote server 104 may be controlled and used by the same entity that operates computer 101. Remote server 104 represents a machine that collects and stores helpful and useful data for use by other computers, such as computer 101. For example, in the hypothetical case where computer 101 is designed and programmed to provide recommendations based on historical data, then that historical data may be provided to computer 101 from remote database 130 of remote server 104.

[0032] The public cloud 105 is any computer system that can be used by multiple entities, which provides on-demand availability of computer system resources and / or other computer capabilities, especially data storage (cloud storage) and computing capabilities, without the need for direct active management by users. Cloud computing generally uses the sharing of resources to achieve consistency and economies of scale. The direct and active management of the computing resources of the public cloud 105 is performed by the computer hardware and / or software of the cloud orchestration module 141. The computing resources provided by the public cloud 105 are generally implemented by virtual computing environments running on various computers that constitute the host physical machine group 142, which is a full set of physical computers in the public cloud 105 and / or available for the public cloud. The virtual computing environment (VCE) is generally in the form of a virtual machine from the virtual machine group 143 and / or a container from the container group 144. It should be understood that these VCEs can be stored as images and can be transmitted between various physical machine hosts as images or after the instantiation of the VCE. The cloud orchestration module 141 manages the transmission and storage of images, deploys new instantiations of VCEs, and manages active instantiations of VCE deployments. Gateway 140 is a collection of computer software, hardware, and firmware that allows public cloud 105 to communicate over WAN 102 .

[0033] Some further explanation of the virtualized computing environment (VCE) will now be provided. A VCE can be stored as an "image". A new active instance of the VCE can be instantiated from the image. Two common types of VCEs are virtual machines and containers. Containers are VCEs that use operating system-level virtualization. This refers to an operating system feature in which the kernel allows the existence of multiple isolated user space instances, known as containers. From the perspective of the programs running therein, these isolated user space instances typically behave as real computers. Computer programs running on ordinary operating systems can utilize all the resources of the computer, such as connected devices, files and folders, network shares, CPU capabilities, and quantifiable hardware capabilities. However, programs running within a container can only use the contents of the container and the devices assigned to the container, which is a feature known as containerization.

[0034] The private cloud 106 is similar to the public cloud 105, except that the computing resources are only available to a single enterprise. Although the private cloud 106 is depicted as communicating with the WAN 102, in other embodiments, the private cloud can be completely disconnected from the Internet and can only be accessed through a local / private network. A hybrid cloud is a combination of multiple clouds of different types (e.g., private, community, or public cloud types), typically implemented by different vendors. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the multiple constituent clouds. In this embodiment, the public cloud 105 and the private cloud 106 are both part of a larger hybrid cloud.

[0035] Reference now Figure 2 , depicts an operational flow chart for authenticating a user via a location sampling / identification multi-factor authentication process 200 according to at least one embodiment. At 202, the authentication program 107A, 107B periodically receives GPS location coordinates of registered electronic devices (e.g., smart phones) that are co-located with the user. According to at least one embodiment, during the initialization / setup phase of the authentication program 107A, 107B, the user may register one or more electronic devices (e.g., smart phones, laptops) that the user may utilize to access another computing device and / or an application of another computing device, awaiting successful authentication of the authentication program 107A, 107B. Each electronic device (e.g., computer 101) registered by the user may execute a local instance of the authentication program 107A, 107B and may utilize a GPS receiver to periodically identify its geographic location coordinates (i.e., latitude and longitude values). The location coordinate identification frequency of the registered devices may be initially specified by the user during the setup phase of the authentication program 107A, 107B, and may be later updated by the user or by the authentication program 107A, 107B. For example, a user may initially specify a location coordinate identification frequency for all registered devices of once every half hour, hour, day, etc. During implementation, the registered devices may periodically identify their geographic location coordinates according to the location coordinate identification frequency and send them to an instance of the authentication program 107A, 107B executed on a second computing device (e.g., end-user device 103, authentication server). In addition, the authentication program 107A, 107B may instruct the registered devices to locally store a moving window of the last n identified location coordinates (e.g., the last four identified location coordinates). The size of the moving window (i.e., the value of n) may be initially specified by the user during the setup phase of the authentication program 107A, 107B and may be updated later by the user or by the authentication program 107A, 107B.

[0036] Next, at 204, the authentication program 107A, 107B stores a moving window of location coordinates received for the registered device on the second computing device. According to at least one embodiment, the stored moving window of location coordinates received from the registered device can be equal in size (i.e., the value of n) to the moving window of identified location coordinates stored on the registered device. For example, the registered device can store the last four of its identified location coordinates within its locally stored moving window, and the second computing device can also store the last four identified location coordinates received from the registered device within its locally stored moving window. In doing so, the registered device and the second computing device can each maintain a moving window of the last four identified location coordinates of the registered device, which are identical to each other (i.e., they each contain the same set of identified location coordinates of the registered device).

[0037] According to at least one other embodiment, in the case where the user has registered multiple electronic devices, the authentication programs 107A, 107B can store a corresponding moving window of the last n identified location coordinates on each registered device. Similarly, the authentication programs 107A, 107B can also store and maintain a corresponding moving window of the last n identified location coordinates received from each registered device within the second computing device.

[0038] At 206, the authentication program 107A, 107B receives a request from the user to access the second computing device and / or the application on the second computing device via the registered device. According to at least one embodiment, the request received from the user may include the user's login credentials (such as a user ID and password) and a hash value of a set of identified location coordinates of a moving window of the last n identified location coordinates stored on the registered device. For example, in the case where the moving window includes the last four identified location coordinates of the registered device, the hash value can be calculated using the last, last two, last three, or last four sets of identified location coordinates from the moving window stored on the registered device. The hash value can be requested by the user on demand and calculated by an instance of the authentication program 107A, 107B executed on the registered device. According to at least one other embodiment, the hash value can be automatically calculated by an instance of the authentication program 107A, 107B executed on the registered device in response to the user's request to access the second computing device and sent together with the user's login credentials. The hash algorithm (H) used by the authentication program 107A, 107B (e.g., a version of the Secure Hash Algorithm (SHA) or the Message Digest Algorithm (MD5)) may be initially specified by the user during a setup phase of the authentication program 107A, 107B, and may be later updated by the user or by the authentication program 107A, 107B. Similarly, the number of identified location coordinates to be hashed (L) may be initially specified by the user during a setup phase of the authentication program 107A, 107B, and may be later updated by the user or by the authentication program 107A, 107B.

[0039] Next, at 208, the authentication program 107A, 107B determines whether the authentication (i.e., verification) of the received user request to access the second computing device is successful. In making this determination, the instance of the authentication program 107A, 107B executed on the second computing device can extract the user ID and password from the received request and compare them to the login credentials (e.g., user ID and password) stored in the database of authorized users of the second computing device. In addition, the instance of the authentication program 107A, 107B executed on the second computing device can also calculate a hash value of the set of identified location coordinates from the moving window of location coordinates received for the registered device and stored on the second computing device. Both the hashing algorithm (H) and the number of identified location coordinates to be hashed (L) utilized by the instance of the authentication program 107A, 107B executed on the second computing device can be the same as H and L utilized by the instance of the authentication program 107A, 107B executed on the registered device. For example, the instance of the authentication program 107A, 107B executed on the registered device can utilize the hash algorithm MD5 to calculate a hash value based on the last three identified location coordinates within the moving window stored locally therein. Similarly, the instance of the authentication program 107A, 107B executed on the second computing device can also utilize the hash algorithm MD5 to calculate a hash value based on the last three identified location coordinates within the moving window stored locally therein by the registered device.

[0040] Continuing with reference to step 208, authentication of the received user request to access the second computing device may be determined to be successful when there is a match between the login credentials (i.e., user ID and password) received at 206 and the login credentials stored in the database of authorized users of the second computing device, and there is a match (i.e., equal values) between the hash value calculated by the instance of authentication program 107A, 107B executing on the registered device and the hash value calculated by the instance of authentication program 107A, 107B executing on the second computing device at 206. It should be noted that any differences between the respective location coordinates used by the instances of authentication program 107A, 107B executing on the registered device and on the second computing device to calculate their respective hash values ​​may cause the respective hash values ​​to be unequal. In the absence of a match between the hash value calculated by the instance of the authentication program 107A, 107B executing on the registered device and the hash value calculated by the instance of the authentication program 107A, 107B executing on the second computing device, the authentication of the received user request to access the second computing device may not be determined to be successful. In response to determining that the authentication of the received user request to access the second computing device is successful (step 208, "yes" branch), the location sampling multi-factor authentication process 200 can proceed to step 210. In response to determining that the authentication of the received user request to access the second computing device is unsuccessful (step 208, "no" branch), the location sampling multi-factor authentication process 200 can proceed to step 212.

[0041] According to at least one other embodiment, whether the authentication of the received user request to access the second computing device is successful can be determined based on a comparison of the stored identified location coordinates of the registered device. In such an embodiment, the authentication program 107A, 107B can compare the last n identified location coordinates of the moving window stored on the registered device with the last n identified location coordinates of the moving window stored on the second computing device. For example, in the case where there is a match between the login credentials (i.e., user ID and password) received at 206 and the login credentials stored in the database of authorized users of the second computing device, and in the case where the respective moving windows stored on the registered device and the second computing device are the same (i.e., the last n identified location coordinates of the registered device stored therein match the last n identified location coordinates of the registered device stored on the second computing device), the authentication of the received user request to access the second computing device can be determined to be successful. In the case where the respective moving windows stored on the registered device and the second computing device are different, the authentication of the received user request to access the second computing device can be determined to be unsuccessful. In response to determining that the authentication of the received user request to access the second computing device is successful (step 208, "yes" branch), the location sampling multi-factor authentication process 200 can proceed to step 210. In response to determining that the authentication of the received user request to access the second computing device is unsuccessful (step 208, "no" branch), the location sampling multi-factor authentication process 200 can proceed to step 212.

[0042] According to another embodiment, in the event that there is no change between two or more identified location coordinates within a moving window of location coordinates received for the registered device and stored on the second computing device, the authentication program 107A, 107B may additionally utilize or recover the OTP during the determination of whether the authentication of the received user request to access the second computing device is successful. For example, if the last two or more identified location coordinates of the last n identified location coordinates within a moving window received for the registered device and stored on the second computing device are the same (i.e., no change), then the instance of the authentication program 107A, 107B executed on the second computing device may additionally utilize the OTP process as part of determining whether the authentication of the received user request to access the second computing device is successful.

[0043] At 210, in response to determining that authentication of the received user request to access the second computing device is successful, the instance of the authentication program 107A, 107B executed on the second computing device grants the user access to the second computing device and / or applications on the second computing device via the registered device. Thus, by using the location sampling / identification multi-factor authentication process 200, although multi-factor authentication is implemented, the user gains access to the second computing device after one round-trip communication between the registered device and the second computing device.

[0044] According to at least one other embodiment, in response to determining that authentication of the received user request to access the second computing device was successful, the instance of the authentication program 107A, 107B executing on the second computing device may also determine whether updates are needed to one or more of the following: the location coordinate identification frequency (F), the size of the moving window maintained on the registered device and on the second computing device (N), the hashing algorithm utilized by the registered device and the second computing device (H), and the number of identified location coordinates to be hashed using H (L). As described above, the values ​​of F, N, H, and L may be initially configured by the user during a setup phase and uniformly implemented on the registered device and on the instances of the authentication program 107A, 107B executing on the second computing device. After setup, the instance of authentication program 107A, 107B executing on the second computing device may unilaterally determine that one or more of F, N, H, and L need to be updated, and send an update message to the instance of authentication program 107A, 107B executing on the registered device while the user is currently granted access to the second computing device and / or the application on the second computing device or before the user is granted access to the second computing device and / or the application on the second computing device. The update message may contain information specifying new values ​​of one or more of F, N, H, and L to be uniformly implemented on all executing instances of authentication program 107A, 107B. The instance of authentication program 107A, 107B executing on the second computing device may update one or more of F, N, H, and L when the update message is sent, and the instance of authentication program 107A, 107B executing on the registered device may update one or more of F, N, H, and L when the update message is received.

[0045] For example, in a case where the location coordinates of a registered device are frequently identified (e.g., every 30 minutes) and the frequency of access requests (i.e., logins) from a user's second computing device is infrequent (e.g., once every 3 days), it may be determined that the location coordinate identification frequency (F) needs to be changed. In such a case, the instance of the authentication program 107A, 107B executed on the second computing device may determine that the location coordinate identification frequency needs to be reduced. As another example, in a case where a hashing algorithm (H) has been used for more than a threshold amount of time (e.g., several hours or several days), it may be determined that the hashing algorithm (H) utilized by the registered device and the second computing device needs to be changed. As yet another example, as a result of user movement behavior, it may be determined that the number of identified location coordinates to be hashed using H needs to be changed (L). For example, in a case where the user is not moving frequently and the current L value results in unchanged location coordinates being hashed, the instance of the authentication program 107A, 107B executed on the second computing device may determine that L needs to be increased.

[0046] At 212, in response to determining that authentication of the received user request to access the second computing device is unsuccessful, the instance of authentication program 107A, 107B executing on the second computing device denies user access to the second computing device and / or applications on the second computing device via the registered device. The instance of authentication program 107A, 107B executing on the second computing device may also send a message to the registered device indicating the reason for denying access.

[0047] Understandably, Figure 2 This merely provides an illustration of one implementation and does not imply any limitation on how different embodiments may be implemented.Many modifications to the depicted environments may be made based on design and implementation requirements.

[0048] The description of various embodiments of the present invention has been given for the purpose of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found on the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method, the method comprising: receiving, from the first device, a plurality of location coordinates of the first device; storing, on a second device, a second moving window including the last n position coordinates of the plurality of position coordinates; receiving a request from the first device to access the second device, wherein the request includes login credentials of a user and the first hash value; On the second device, calculating a second hash value based on the set of last n position coordinates of the second moving window; verifying the login credentials of the user; comparing the first hash value and the second hash value; and In response to the first hash value and the second hash value being equal, and the login credentials being verified, access to the second device via the first device is granted.

2. The method according to claim 1, further comprising: A first moving window including last n position coordinates of the plurality of position coordinates is stored on the first device, wherein the position coordinates of the plurality of position coordinates are identified according to a position coordinate identification frequency and transmitted to the second device.

3. The method according to claim 2, wherein: The first hash value is calculated on the first device and is based on a set of last n position coordinates of the first moving window.

4. The method according to claim 3, wherein: The first hash value and the second hash value are calculated using the same hash algorithm, and wherein the set of last n position coordinates of the first moving window and the set of last n position coordinates of the second moving window have the same set size, and wherein the set size includes the number of position coordinates.

5. A method according to any one of the preceding claims, wherein: Verifying the login credentials of the user further comprises: extracting a user ID and password from said login credentials; comparing the user ID and the password to user IDs and passwords stored in a database of authorized users of the second device; and Confirm that the user ID and the password match.

6. A method according to any one of the preceding claims, wherein: The first device is co-located with the user.

7. A method according to any one of the preceding claims, wherein: The plurality of location coordinates include Global Positioning System (GPS) coordinates.

8. A computer system, comprising: One or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one of the one or more tangible storage media for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising: receiving, from the first device, a plurality of location coordinates of the first device; storing, on a second device, a second moving window including the last n position coordinates of the plurality of position coordinates; receiving a request from the first device to access the second device, wherein the request includes login credentials of a user and the first hash value; On the second device, calculating a second hash value based on the set of last n position coordinates of the second moving window; verifying the login credentials of the user; comparing the first hash value and the second hash value; and In response to the first hash value and the second hash value being equal, and the login credentials being verified, access to the second device via the first device is granted.

9. The computer system of claim 8, further comprising: A first moving window including last n position coordinates of the plurality of position coordinates is stored on the first device, wherein the position coordinates of the plurality of position coordinates are identified according to a position coordinate identification frequency and transmitted to the second device.

10. The computer system according to claim 9, wherein: The first hash value is calculated on the first device and is based on a set of last n position coordinates of the first moving window.

11. The computer system according to claim 10, wherein: The first hash value and the second hash value are calculated using the same hash algorithm, and wherein the set of last n position coordinates of the first moving window and the set of last n position coordinates of the second moving window have the same set size, and wherein the set size includes the number of position coordinates.

12. The computer system according to any one of claims 8 to 11, wherein: Verifying the login credentials of the user further comprises: extracting a user ID and password from said login credentials; comparing the user ID and the password to user IDs and passwords stored in a database of authorized users of the second device; and Confirm that the user ID and the password match.

13. The computer system according to any one of claims 8 to 12, wherein: The first device is co-located with the user.

14. The computer system according to any one of claims 8 to 13, wherein: The plurality of location coordinates include Global Positioning System (GPS) coordinates.

15. A computer program product, the computer program product comprising: One or more computer-readable tangible storage media and program instructions stored on at least one of the one or more tangible storage media, the program instructions being executable by a processor capable of performing a method comprising: receiving, from the first device, a plurality of location coordinates of the first device; storing, on a second device, a second moving window including the last n position coordinates of the plurality of position coordinates; receiving a request from the first device to access the second device, wherein the request includes login credentials of a user and the first hash value; On the second device, calculating a second hash value based on the set of last n position coordinates of the second moving window; verifying the login credentials of the user; comparing the first hash value and the second hash value; and In response to the first hash value and the second hash value being equal, and the login credentials being verified, access to the second device via the first device is granted.

16. The computer program product of claim 15, further comprising: A first moving window including last n position coordinates of the plurality of position coordinates is stored on the first device, wherein the position coordinates of the plurality of position coordinates are identified according to a position coordinate identification frequency and transmitted to the second device.

17. The computer program product of claim 16, wherein: The first hash value is calculated on the first device and is based on a set of last n position coordinates of the first moving window.

18. The computer program product of claim 17, wherein: The first hash value and the second hash value are calculated using the same hash algorithm, and wherein the set of last n position coordinates of the first moving window and the set of last n position coordinates of the second moving window have the same set size, and wherein the set size includes the number of position coordinates.

19. The computer program product according to any one of claims 15 to 18, wherein: Verifying the login credentials of the user further comprises: extracting a user ID and password from said login credentials; comparing the user ID and the password to user IDs and passwords stored in a database of authorized users of the second device; and Confirm that the user ID and the password match.

20. A computer program product according to any one of claims 15 to 19, wherein: The first device is co-located with the user.

21. A computer program comprising computer program code means adapted to perform the method according to any one of claims 1 to 7 when said program is run on a computer.

Images