Office Action 1: Notice of Allowance (2025-05-13)

CLAIMS:
WHAT IS CLAIMED IS:

1\. A game login method, comprising:
receiving a login request for logging into a game sent by a client computing device, wherein the login request carries a login account;
determining at least two groups of corresponding network addresses based on the login account;
determining whether the client computing device belongs to a lock region based on a lock region configuration corresponding to the login request and the at least two groups of corresponding network addresses; and
in response to determining that the client device does not belong to the lock region, performing login based on the login request.

2\. The game login method according to claim 1, wherein the determining at least two groups of corresponding network addresses based on the login account comprises:
determining a current login address of the login account; and
obtaining, from a historical record, at least one group of historical network addresses corresponding to the login account, wherein each group of historical network addresses comprises a login address and a corresponding reporting heartbeat address.

3\. The game login method according to claim 2, wherein the obtaining, from a historical record, at least one group of historical network addresses corresponding to the login account further comprises:
determining whether the at least one group of historical network addresses is valid;
in response to determining that a group of invalid historical network addresses exists in the at least one group of historical network addresses, deleting the group of invalid historical network addresses; and
determining a number of groups of invalid historical network addresses that are deleted, and continuing to obtain the same number of groups of historical network addresses from the historical record.

4\. The game login method according to claim 3, wherein the determining whether the at least one group of historical network addresses is valid cormprises:
determining whether the login address and the corresponding reporting heartbeat address comprised in each group of historical network addresses are in a same region; in response to determining that the login address and the corresponding reporting heartbeat address are in the sane region, determining that a corresponding group of historical network addresses is valid; and
in response to determining that the login address and the corresponding reporting heartbeat address are not in the satne region, determining that the corresponding group of historical network addresses is invalid.

5\. The game login tmethod according to any one of claims 1 to 4, wherein the detertmining whether the client computing device belongs to a lock region based on a lock region configuration corresponding to the login request and the at least two groups of corresponding network addresses comprises:
determining whether each of the at least two groups of corresponding network addresses belongs to the lock region;
cormputing a first proportion of one or more groups of network addresses belonging to the lock region in the at least two groups of corresponding network addresses; and
determining that the client computing device does not belong to the lock regionwhen the first proportion is less than or equal to a first threshold;
determining that the client computing device belongs to the lock region when the first proportion is greater than or equal to a second threshold; and
obtaining device information of the client computing device and determining whether the client computing device belongs to the lock region based on the device informationwhen the first proportionis greater than a first threshold and less than a second threshold.
6\. The game login method according to claim5,wherein the determining whether the client computing device belongs to the lock region based on the device information comprtSVG {EMBED HERE} 0.1130.287 determining whether the device infortmationcomprises a device region; when the deviceinformationcomprises the device region, determining that the client computing device belongs to the lock region in response to detennining the device region belongs to the lock region, and detennining that the client computing device does not belong to the lock region in response to

determining that the device region does not belong to the lock region;when the device information does not comprise the device region, determining whether the device information comprises language information;
when the device information comprises the language information, determining that the client computing device belongs to the lock region in response to determining that a language indicated by the language information belongs to a language corresponding to the lock region, and determining that the client computing device does not belong to the lock region in response to determining that the language indicated by the language infonnation does not belong to the language corresponding to the lock region.
7\. The game login method according to any one of claims 1 to 6, wherein the login request further carries a client identification code associated with the clientcomputing device,andwheretSVG {EMBED HERE} 0.1130.127 before the determining at least two groups of corresponding network addresses based on the login account, the game login method further comprises:
determining whether the client identification code is an identification code in a preset whitelist;
tn response to determining that the client identification code is not in the preset whitelist, perforning the obtaining at least two groups of corresponding network addresses based on the login account; and
tnresponse to determining that the client identification code is in the preset whitelist, determining that the client computing device does not belong to the lock region.

8\. The game login method according to any one of claims 1 to 7, wherein before the detennining at least two groups of corresponding network addresses based on the login account, the game login method further comprises:
determining whether the lock region configuration is pre-stored locally;
in response to determining that the lock region configuration is pre-stored locally, performing the obtaining at least two groups of corresponding network addresses based on the login account;
and in response to determining that the lock region configuration is not pre-stored locally, determining that the client computing device does not belong to the lock region.

9\. The game login method according to any one of claims 1 to 8, wherein before the receiving

a login request for logging into a game sent by a client computing device, the game login method further comprises:receiving a request of lock region configuration sent by a configurator, wherein the request of lock region configuration carries the lock region configuration and information indicative of a corresponding lockobject that is restricted from login; and
storing the lock region configuration, the corresponding lockobject, and a corresponding relationship between them.

10\. The game login method according to any one of claims 1 to 9, wherein the login request further carries information indicative of an object for login, and wherein before the determining whether the client computing device belongs to a lock region based on a lock region configuration corresponding to the login request and the at least two groups of corresponding network addresses, the game login method further comprises:
determining the lock region configuration based on the information indicative of the object for login carried in the login request.

11\. The game login method according to any one of claims l to 10, wherein after the performing login based on the login request, the game login tmethod further comprises:
obtaining a reporting heartbeat address of the client computing device; and
recording, in a historical record, the reporting heartbeat address and a current login address of the client computing device.

12\. A game login apparatus, comprising:
a receiving module, configured to receive a login request sent by a client computing device, wherein the login request carries a login account;
a first obtaining module, configured to obtain at least two groups of corresponding network addresses based on the login account;
a first determining module, configured to determine whether the client computing device belongs to a lock region based on a lock region configuration and the at least two groups of corresponding network addresses, wherein the lock region configuration is determined based on the login request; and

a login module, configured to: perform login based on the login request in response to determining that the client device does not belong to the lock region.

13\. A computing device, comprising:
a memory and a processor, wherein the memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions to implement operations comprising:
receiving a login request sent by a client computing device, wherein the login request carries a login account;
determining at least two groups of corresponding network addresses based on the login account;
determining whether the client computing device belongs to a lock region based on a lock region configuration and the at least two groups of corresponding network addresses, wherein the lock region configuration is determined based on the login request; and
in response to determining that the client device does not belong to the lock region, performing login based on the login request.

14\. A computer-readable storage medium, wherein the computer-readable storage mediumstores computer instructions, and the computer instructions are executable by a processor to implement the game login method according to any one of claims1 to 11.

15\. A computer program product, wherein when the computer program product is executable by a computer, the computer is enabled to perform the game login method according to any one of claims 1 to 11.

OFFICE ACTION:
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Allowable Subject Matter
Claims 1-11, 13-14, 16-22 are allowed.
The following is an examiner’s statement of reasons for allowance: The specific limitations of (with respect to Claims 1, 13, 14) “receiving a login request for logging into a game sent by a client computing device, wherein the login request carries a login account; determining at least two groups of corresponding network addresses based on the login account; determining whether the client computing device belongs to a lock region based on a lock region configuration corresponding to the game and the at least two groups of corresponding network addresses, wherein the lock region indicates one or more regions in which at least a part of the game is not accessible by client computing devices belonging to the lock region; and in response to determining that the client device does not belong to the lock region, performing login based on the login request”, in combination with the remainder of the respective claims are not anticipated or made obvious over the prior art of record in the Examiner’s opinion.
A game login method is well known in the art. For instance, Vaughan (2014/0045596) in view of O’Hare et al. (2021/0126940) teaches a game login method. However, Vaughan in view of O’Hare is silent on “receiving a login request for logging into a game sent by a client computing device, wherein the login request carries a login account; determining at least two groups of corresponding network addresses based on the login account; determining whether the client computing device belongs to a lock region based on a lock region configuration corresponding to the game and the at least two groups of corresponding network addresses, wherein the lock region indicates one or more regions in which at least a part of the game is not accessible by client computing devices belonging to the lock region; and in response to determining that the client device does not belong to the lock region, performing login based on the login request”.
As a result, in the Examiner’s opinion, the present invention is not anticipated or made obvious over the prior art.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion



CITED REFERENCE SUMMARIES: Ref US20140045596A1: Claims:
A computer-implemented method for determining a location of a client using a computer device coupled to a memory device, the method comprising: receiving an initial connection request; identifying at least one client characteristic, wherein the at least one client characteristic includes an internet protocol (IP) address and a client-provided location; analyzing, using the computer device, the at least one client characteristic to determine the location of the client; and allowing the client to use the computer device if the location is within a pre-determined area.
receiving an initial connection request;
identifying at least one client characteristic, wherein the at least one client characteristic includes an internet protocol (IP) address and a client-provided location;
analyzing, using the computer device, the at least one client characteristic to determine the location of the client; and
allowing the client to use the computer device if the location is within a pre-determined area.
The computer-implemented method of claim 1 , further comprising providing a secondary verification if the location is not within the pre-determined area, wherein the second verification includes requesting a location from a mobile device.
The computer-implemented method of claim 1 , wherein identifying at least one client characteristic includes identifying at least one client characteristic, wherein the at least one client characteristic further includes port scan results and identification information.
The computer-implemented method of claim 3 , wherein the identification information includes at least one of a browser version, an operating system version, a screen resolution, and a cookie.
The computer-implemented method of claim 3 , wherein analyzing the at least one client characteristic comprises: conducting a plurality of tests based on the at least one client characteristic, wherein each of the plurality of tests produces a test result; assigning a weight to each test result; and determining if a sum of the weighted test results meets a pre-determined threshold.
conducting a plurality of tests based on the at least one client characteristic, wherein each of the plurality of tests produces a test result;
assigning a weight to each test result; and
determining if a sum of the weighted test results meets a pre-determined threshold.
The computer-implemented method of claim 5 , wherein the plurality of tests includes comparing the IP address with an IP success history.
The computer-implemented method of claim 5 , wherein the plurality of tests includes comparing the IP address with a list of known proxies.
The computer-implemented method of claim 5 , wherein the plurality of tests includes comparing the port scan results with a list of remote desktop ports.
A computer program product tangibly embodied in a non-transitory computer-readable storage device and comprising instructions that, when executed by a processor, cause the processor to: receive an initial connection request; identify at least one client characteristic, wherein the at least one client characteristic includes an internet protocol (IP) address and a client-provided location; analyze, by the processor, the at least one client characteristic to determine the location of the client; and allow the client to use the computer device if the location is within a pre-determined area.
receive an initial connection request;
identify at least one client characteristic, wherein the at least one client characteristic includes an internet protocol (IP) address and a client-provided location;
analyze, by the processor, the at least one client characteristic to determine the location of the client; and
allow the client to use the computer device if the location is within a pre-determined area.
The computer program product of claim 9 , further comprising instructions that when executed cause the processor to provide a secondary verification if the location is not within the pre-determined area, wherein the second verification includes requesting a location from a mobile device.
The computer program product of claim 9 , wherein identifying at least one client characteristic includes identifying at least one client characteristic, wherein the at least one client characteristic further includes port scan results and identification information.
The computer program product of claim 11 , wherein the identification information includes at least one of a browser version, an operating system version, a screen resolution, and a cookie.
The computer program product of claim 11 , further comprising instructions that when executed cause the processor to: conduct a plurality of tests based on the at least one client characteristic, wherein each of the plurality of tests produces a test result; assign a weight to each test result; and determine if a sum of the weighted test results meets a pre-determined threshold.
conduct a plurality of tests based on the at least one client characteristic, wherein each of the plurality of tests produces a test result;
assign a weight to each test result; and
determine if a sum of the weighted test results meets a pre-determined threshold.
The computer program product of claim 13 , wherein the plurality of tests includes comparing the IP address with an IP success history.
The computer program product of claim 13 , wherein the plurality of tests includes comparing the IP address with a list of known proxies.
The computer program product of claim 13 , wherein the plurality of tests includes comparing the port scan results with a list of remote desktop ports.
A computer system including instructions stored on a non-transitory computer-readable medium and executable by at least one processor, the computer system comprising: a connection manager configured to receive an initial connection request; and a client location manager configured to: identify at least one client characteristic, wherein the at least one client characteristic includes an internet protocol (IP) address and a client-provided location; analyze, by the computer system, the at least one client characteristic to determine the location of the client; and allowing the client to use the computer system if the location is within a pre-determined area.
a connection manager configured to receive an initial connection request; and
a client location manager configured to: identify at least one client characteristic, wherein the at least one client characteristic includes an internet protocol (IP) address and a client-provided location; analyze, by the computer system, the at least one client characteristic to determine the location of the client; and allowing the client to use the computer system if the location is within a pre-determined area.
analyze, by the computer system, the at least one client characteristic to determine the location of the client; and
allowing the client to use the computer system if the location is within a pre-determined area.
The computer system of claim 17 , wherein identifying at least one client characteristic includes identifying at least one client characteristic, wherein the at least one client characteristic further includes port scan results and identification information.
The computer system of claim 17 , wherein the identification information includes at least one of a browser version, an operating system version, a screen resolution, and a cookie.
The computer system of claim 17 , wherein the client location manager is configured to analyze the at least one client characteristic by: conducting a plurality of tests based on the at least one client characteristic, wherein each of the plurality of tests produces a test result; assigning a weight to each test result; and determining if a sum of the weighted test results meets a pre-determined threshold.
Ref US11218473B2: Claims:
A system for identifying suspicious logins, the system comprising: a memory storing executable instructions; at least one processor configured to execute the instructions to perform operations comprising: receiving a first user login from an electronic device, the first user login comprising login credentials; receiving a second user login from an electronic device, the second user login comprising login credentials; identifying at least one second user login device characteristic; analyzing a plurality of device history characteristics to establish an activity pattern, wherein: the plurality of device history characteristics includes a network mapping and at least one first user login device history characteristic, and the activity pattern comprises the submission of login credentials from a plurality of network addresses associated with a plurality of locations; analyzing the plurality of device history characteristics to determine a confidence interval; comparing the at least one second user login device characteristic to the activity pattern; determining, based on the comparison and the confidence interval, that the first and second user logins originate from different electronic devices; identifying, based on the plurality of device history characteristics, a hardware configuration of the electronic device of the second user login as being a duplicate of a hardware configuration of the electronic device of the first user login; identifying, based on the determination, the second user login as a suspicious login; sending, to a user, a notification of the identified suspicious login; modifying, based on the notification, security settings on an account of the user; and signing out of the electronic device of the first user login, based on the notification.
a memory storing executable instructions;
at least one processor configured to execute the instructions to perform operations comprising: receiving a first user login from an electronic device, the first user login comprising login credentials; receiving a second user login from an electronic device, the second user login comprising login credentials; identifying at least one second user login device characteristic; analyzing a plurality of device history characteristics to establish an activity pattern, wherein: the plurality of device history characteristics includes a network mapping and at least one first user login device history characteristic, and the activity pattern comprises the submission of login credentials from a plurality of network addresses associated with a plurality of locations; analyzing the plurality of device history characteristics to determine a confidence interval; comparing the at least one second user login device characteristic to the activity pattern; determining, based on the comparison and the confidence interval, that the first and second user logins originate from different electronic devices; identifying, based on the plurality of device history characteristics, a hardware configuration of the electronic device of the second user login as being a duplicate of a hardware configuration of the electronic device of the first user login; identifying, based on the determination, the second user login as a suspicious login; sending, to a user, a notification of the identified suspicious login; modifying, based on the notification, security settings on an account of the user; and signing out of the electronic device of the first user login, based on the notification.
receiving a first user login from an electronic device, the first user login comprising login credentials;
receiving a second user login from an electronic device, the second user login comprising login credentials;
identifying at least one second user login device characteristic;
analyzing a plurality of device history characteristics to establish an activity pattern, wherein: the plurality of device history characteristics includes a network mapping and at least one first user login device history characteristic, and the activity pattern comprises the submission of login credentials from a plurality of network addresses associated with a plurality of locations;
the plurality of device history characteristics includes a network mapping and at least one first user login device history characteristic, and
the activity pattern comprises the submission of login credentials from a plurality of network addresses associated with a plurality of locations;
analyzing the plurality of device history characteristics to determine a confidence interval;
comparing the at least one second user login device characteristic to the activity pattern;
determining, based on the comparison and the confidence interval, that the first and second user logins originate from different electronic devices;
identifying, based on the plurality of device history characteristics, a hardware configuration of the electronic device of the second user login as being a duplicate of a hardware configuration of the electronic device of the first user login;
identifying, based on the determination, the second user login as a suspicious login;
sending, to a user, a notification of the identified suspicious login;
modifying, based on the notification, security settings on an account of the user; and
signing out of the electronic device of the first user login, based on the notification.
The system of claim 1 , wherein the operations further comprise: identifying, based on the plurality of device history characteristics, the login credentials of the second user login as being a duplicate of the login credentials of the first user login.
identifying, based on the plurality of device history characteristics, the login credentials of the second user login as being a duplicate of the login credentials of the first user login.
The system of claim 1 , wherein the plurality of device history characteristics comprise at least one of a device name, a device location, a device timestamp, a device version, financial transaction metadata, a network address, or a stored electronic fingerprint.
The system of claim 1 , wherein the operations further comprise: identifying, when an aggregation of the plurality of device history characteristics fail to meet a predetermined confidence level, the second user login as a suspicious login.
identifying, when an aggregation of the plurality of device history characteristics fail to meet a predetermined confidence level, the second user login as a suspicious login.
The system of claim 1 , wherein the operations further comprise: notifying the user of the identified suspicious login by at least one of a text message or a graphical user interface (GUI) transmitted to the user.
notifying the user of the identified suspicious login by at least one of a text message or a graphical user interface (GUI) transmitted to the user.
The system of claim 1 , wherein the operations further comprise at least one of: locking the account of the user, ending a session of the user, or revoking a device authorization.
locking the account of the user, ending a session of the user, or revoking a device authorization.
A method for identifying suspicious logins, the method comprising: receiving a first user login from an electronic device, the first user login comprising login credentials; receiving a second user login from an electronic device, the second user login comprising login credentials; identifying at least one second user login device history characteristic; analyzing a plurality of device history characteristics to establish an activity pattern, wherein: the plurality of device history characteristics includes a network mapping and at least one first user login device history characteristic, and the activity pattern comprises the submission of login credentials from a plurality of network addresses associated with a plurality of locations; analyzing the plurality of device history characteristics to determine a confidence interval; comparing the at least one second user login device characteristic to the activity pattern; determining, based on the comparison and the confidence interval, that the first and second user logins originate from different electronic devices; identifying, based on the plurality of device history characteristics, a hardware configuration of the electronic device of the second user login as being a duplicate of a hardware configuration of the electronic device of the first user login; identifying, based on the determination, the second user login as a suspicious login; sending, to a user, a notification of the identified suspicious login; modifying, based on the notification, security settings on an account of the user; and signing out of the electronic device of the first user login, based on the notification.
identifying at least one second user login device history characteristic;
The method of claim 7 , further comprising: identifying, based on the plurality of device history characteristics, the login credentials of the second user login as being a duplicate of the login credentials of the first user login.
The method of claim 7 , wherein the plurality of device history characteristics comprise at least one of a device name, a device location, a device timestamp, a device version, financial transaction metadata, a network address, or a stored electronic fingerprint.
The method of claim 7 , further comprising: identifying, when an aggregation of the plurality of device history characteristics fails to meet a predetermined confidence level, the second user login as a suspicious login.
identifying, when an aggregation of the plurality of device history characteristics fails to meet a predetermined confidence level, the second user login as a suspicious login.
The method of claim 7 , further comprising: locking the account of the user, ending a session of the user, or revoking a device authorization.
A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising: receiving a first user login from an electronic device, the first user login comprising login credentials; receiving a second user login from an electronic device, the second user login comprising login credentials; identifying at least one second user login device history characteristic; analyzing a plurality of device history characteristics to establish an activity pattern, wherein: the plurality of device history characteristics includes a network mapping and at least one first user login device history characteristic, and the activity pattern comprises the submission of login credentials from a plurality of network addresses associated with a plurality of locations; analyzing the plurality of device history characteristics to determine a confidence interval; comparing the at least one second user login device characteristic to the activity pattern; determining, based on the comparison and the confidence interval, that the first and second user logins originate from different electronic devices; identifying, based on the plurality of device history characteristics, a hardware configuration of the electronic device of the second user login as being a duplicate of a hardware configuration of the electronic device of the first user login; identifying, based on the determination, the second user login as a suspicious login; sending, to a user, a notification of the identified suspicious login; modifying, based on the notification, security settings on an account of the user; and signing out of the electronic device of the first user login, based on the notification.
The non-transitory computer-readable medium of claim 12 , further comprising: identifying, based on the plurality of device history characteristics, the login credentials of the second user login as being a duplicate of the login credentials of the first user login.
The non-transitory computer-readable medium of claim 12 , wherein the plurality of device history characteristics comprise at least one of a device name, a de
[Truncated to input limit]