Patent ID: 9578499
Date: 2017-02-21
CPC Classifications: G06F,H04L,H04W

Claim:
1. A computer implemented method comprising: receiving, by an online system, a login request to create a session for a user account of the online system, the login request received from a mobile device having a cryptographic key stored in a permanent storage area of the mobile device at manufacturing of the device and uniquely identifying the mobile device; determining that the session is a first login session for the mobile device based on comparing a unique identifier of the mobile device with one or more stored unique identifiers for the user account; associating, by the online system, the mobile device with the user account; storing, by the online system, a public key in association with the user account, the public key corresponding to the cryptographic key; receiving a subsequent request to create a session for the user account from a client device separate from the previously associated mobile device; determining whether the subsequent request is suspicious based at least in part on a result of attempting to decrypt an encrypted message received from the client device using the stored public key associated with the user account; in response to determining that the subsequent request is suspicious, providing a request to a user associated with the user account requiring the user to send a verifying request to create a session from the previously associated mobile device; receiving the verifying request from the previously associated mobile device; and verifying an authenticity of the previously associated mobile device by decrypting a message received from the previously associated mobile device.