Granted Patent B2

US 12,418,529 · App. 18/303,054 · Granted Sep 16, 2025

Inventors: Krishnan Sugavanam (Mahopac, NY); Aris Gkoulalas-Divanis (Waltham, MA); Sophie Batchelder (Cambridge, MA); Uri Kartoun (Cambridge, MA)

Assignee: International Business Machines Corporation

H04L63/0876H04L63/083H04L63/107

Abstract

Claims (67)

1. A computer-implemented method, the method comprising:

receiving, at an authentication server, multiple location coordinates from a first registered device;

receiving, at the authentication server, multiple location coordinates from a second registered device, wherein the first registered device and the second registered device are separate devices which are both co-located with a user;

storing, on the authentication server, respective moving windows comprising registered, device specific, last n location coordinates of the multiple location coordinates from the first registered device and the multiple location coordinates from the second registered device, wherein n is two or more;

receiving a request to access the authentication server via the first registered device, wherein the request comprises log-in credentials of the user and a first hash value calculated at the first registered device;

computing, at the authentication server, a second hash value based on a set of the last n location coordinates from each of the respective moving windows;

verifying the log-in credentials of the user;

comparing the first hash value and the second hash value; and

in response to the first hash value and the second hash value being equal, and the log-in credentials being verified, granting access to the authentication server via the first registered device.

2. The method of claim 1 , further comprising:

storing, on the first registered device and the second registered device, respective moving windows comprising registered device specific last n location coordinates of the respective multiple location coordinates, wherein location coordinates of the respective multiple location coordinates are identified and sent to the authentication server according to a location coordinate identification frequency.

3. The method of claim 2 , wherein receiving the request to access the authentication server via the first registered device further comprises:

receiving, at the first registered device from the second registered device, a set of identified location coordinates of the second registered device, wherein the first registered device and the second registered device communicate with each other via a short-range wireless communication protocol; and

calculating, at the first registered device, the first hash value based on a set of last n location coordinates from each of the respective moving window stored on the first registered device and the received set of identified location coordinates of the second registered device.

4. The method of claim 3 , wherein the first hash value and the second hash value are computed using a same hashing algorithm, and wherein the set of the last n location coordinates used to calculate the first hash value and the set of the last n location coordinates used to calculate the second hash value have a same set size, and wherein a set size comprises a number of location coordinates.

5. The method of claim 1 , wherein verifying the log-in credentials of the user further comprises:

extracting a user id and a password from the log-in credentials;

comparing the user id and the password against user ids and passwords stored in a database of authorized users of the authentication server; and

determining a match for the user id and the password.

6. The method of claim 1 , further comprising:

denying access to the authentication server via the first device in response to a determination that a set of identified location coordinates of the second registered device has not been received at the first registered device from the second registered device.

7. The method of claim 1 , wherein the first registered device and the second registered device are registered with the authentication server, and wherein the respective multiple location coordinates comprise Global Positioning System (GPS) coordinates.

8. A computer system, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:

receiving, at an authentication server, multiple location coordinates from a first registered device;

receiving, at the authentication server, multiple location coordinates from a second registered device, wherein the first registered device and the second registered device are both separate devices co-located with a user;

storing, on the authentication server, respective moving windows comprising registered, device specific, last n location coordinates of the multiple location coordinates from the first registered device and the multiple location coordinates from the second registered device, wherein n is two or more;

receiving a request to access the authentication server via the first registered device, wherein the request comprises log-in credentials of the user and a first hash value calculated at the first registered device;

computing, at the authentication server, a second hash value based on a set of the last n location coordinates from each of the respective moving windows;

verifying the log-in credentials of the user;

comparing the first hash value and the second hash value; and

in response to the first hash value and the second hash value being equal, and the log-in credentials being verified, granting access to the authentication server via the first registered device.

9. The computer system of claim 8 , further comprising:

storing, on the first registered device and the second registered device, respective moving windows comprising registered device specific last n location coordinates of the respective multiple location coordinates, wherein location coordinates of the respective multiple location coordinates are identified and sent to the authentication server according to a location coordinate identification frequency.

10. The computer system of claim 9 , wherein receiving the request to access the authentication server via the first registered device further comprises:

receiving, at the first registered device from the second registered device, a set of identified location coordinates of the second registered device, wherein the first registered device and the second registered device communicate with each other via a short-range wireless communication protocol; and

calculating, at the first registered device, the first hash value based on a set of last n location coordinates from each of the respective moving window stored on the first registered device and the received set of identified location coordinates of the second registered device.

11. The computer system of claim 10 , wherein the first hash value and the second hash value are computed using a same hashing algorithm, and wherein the set of the last n location coordinates used to calculate the first hash value and the set of the last n location coordinates used to calculate the second hash value have a same set size, and wherein a set size comprises a number of location coordinates.

12. The computer system of claim 8 , wherein verifying the log-in credentials of the user further comprises:

extracting a user id and a password from the log-in credentials;

comparing the user id and the password against user ids and passwords stored in a database of authorized users of the authentication server; and

determining a match for the user id and the password.

13. The computer system of claim 8 , further comprising:

denying access to the authentication server via the first device in response to a determination that a set of identified location coordinates of the second registered device has not been received at the first registered device from the second registered device.

14. The computer system of claim 8 , wherein the first registered device and the second registered device are registered with the authentication server, and wherein the respective multiple location coordinates comprise Global Positioning System (GPS) coordinates.

15. A computer program product, the computer program product comprising:

one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor capable of performing a method, the method comprising:

receiving, at an authentication server, multiple location coordinates from a first registered device;

receiving, at the authentication server, multiple location coordinates from a second registered device, wherein the first registered device and the second registered device are both separate devices co-located with a user;

storing, on the authentication server, respective moving windows comprising registered, device specific, last n location coordinates of the multiple location coordinates from the first registered device and the multiple location coordinates from the second registered device, wherein n is two or more;

receiving a request to access the authentication server via the first registered device, wherein the request comprises log-in credentials of the user and a first hash value calculated at the first registered device;

computing, at the authentication server, a second hash value based on a set of the last n location coordinates from each of the respective moving windows;

verifying the log-in credentials of the user;

comparing the first hash value and the second hash value; and

in response to the first hash value and the second hash value being equal, and the log-in credentials being verified, granting access to the authentication server via the first registered device.

16. The computer program product of claim 15 , further comprising:

storing, on the first registered device and the second registered device, respective moving windows comprising registered device specific last n location coordinates of the respective multiple location coordinates, wherein location coordinates of the respective multiple location coordinates are identified and sent to the authentication server according to a location coordinate identification frequency.

17. The computer program product of claim 16 , wherein receiving the request to access the authentication server via the first registered device further comprises:

receiving, at the first registered device from the second registered device, a set of identified location coordinates of the second registered device, wherein the first registered device and the second registered device communicate with each other via a short-range wireless communication protocol; and

calculating, at the first registered device, the first hash value based on a set of last n location coordinates from each of the respective moving window stored on the first registered device and the received set of identified location coordinates of the second registered device.

18. The computer program product of claim 17 , wherein the first hash value and the second hash value are computed using a same hashing algorithm, and wherein the set of the last n location coordinates used to calculate the first hash value and the set of the last n location coordinates used to calculate the second hash value have a same set size, and wherein a set size comprises a number of location coordinates.

19. The computer program product of claim 15 , wherein verifying the log-in credentials of the user further comprises:

extracting a user id and a password from the log-in credentials;

comparing the user id and the password against user ids and passwords stored in a database of authorized users of the authentication server; and

determining a match for the user id and the password.

20. The computer program product of claim 15 , further comprising:

denying access to the authentication server via the first device in response to a determination that a set of identified location coordinates of the second registered device has not been received at the first registered device from the second registered device.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (56)