Un-password: risk aware end-to-end multi-factor authentication via dynamic pairing

• US 10,015,154 B2
• Filed: 03/14/2016
• Issued: 07/03/2018
• Est. Priority Date: 03/17/2013
• Status: Active Grant

• Current Assignee: LogicMark LLC (Nxt-Id, Inc.)
• Original Assignee: Nxt-Id, Inc.
• Inventors: Tunnell, David, Mitchell, Justin, Zurasky, Jacob
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US15/068,834
• Publication Number:
  US 20160197902A1
• Time in Patent Office: 841 Days
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18

Abstract

A method for determining a dynamic pairing code for use in exchanging information between a first and a second communications entity. At the at the first communications entity, determining a first authentication score associated with a first information exchange session between the first and second communications entities, determining a second authentication score associated with a second information exchange session between the first and second communications entities, (the second information exchange spaced apart in time from the first information exchange), combining the first and second authentication scores to create a cumulative risk analysis score, and responsive to the cumulative risk analysis score, generating a dynamic pairing code for use in governing exchange of information during subsequent communications between the first and second communications entities.

Claims

1. A method for determining a dynamic pairing code for use in exchanging information between a first and a second communications device, the method comprising:

at the first communications device;

determining a first authentication score associated with a first information exchange session between the first and second communications devices;

determining a second authentication score associated with a second information exchange session between the first and second communications devices, the second information exchange spaced apart in time from the first information exchange;

combining the first and second authentication scores to create a cumulative risk analysis score;

responsive to the cumulative risk analysis score, generating a dynamic pairing code for use in governing exchange of information during subsequent communications between the first and second communications device; and

encrypting the dynamic pairing code and transmitting the dynamic pairing code to the second communications device.

2. The method of claim 1 wherein the first and second authentication scores are in polynomial form.

3. The method of claim 1 further comprising modifying the cumulative risk analysis score responsive to subsequent information exchanges between the first and second communications devices.

4. The method of claim 1 further comprising sending the dynamic pairing code from the first communications device to the second communications device through a third communications device, the dynamic pairing code encrypted at the third communications device.

5. The method of claim 1 wherein the first communications device comprises an authenticator.

6. The method of claim 1 wherein the second communications device comprises a plurality of second communications devices, each having an authentication score associated with communications with the first communications device, and based thereon each having a dynamic pairing code for use in governing the exchange of information sent to the first communications device.

7. The method of claim 1 wherein the second communications device comprises a mobile device or a computing device.

8. The method of claim 1 wherein the first and second authentication scores are responsive to one or more of user identifiers and access parameters.

9. The method of claim 1 wherein one or both of the first and the second communications devices comprise one of a user, a device, an application, a service, a server, and a software application.

10. The method of claim 1 further comprising:

encrypting the dynamic pairing code to create an encrypted dynamic pairing code;

sending the encrypted dynamic pairing code from the first communications device to the second communications device;

at the second communications device decrypting the encrypted dynamic pairing code using the first authentication score as a decryption key to determine the cumulative risk analysis score; and

at the second communications device determining the second authentication score from the cumulative risk analysis score.

11. The method of claim 10 further comprising:

adding the second authentication score to the cumulative risk analysis score at the second communications device to produce an updated cumulative risk analysis score;

determining whether the updated cumulative risk analysis score is above a threshold value; and

if the updated cumulative risk analysis score is above the threshold value, including the first communications device within an access level of the second communications device, and if the updated cumulative risk analysis score is below the threshold value not exchanging information between the first and second communications devices.

12. The method of claim 11 comprising a plurality of access levels based on a relationship between the updated cumulative risk analysis score and a threshold value associated with each one of the plurality of access levels.

13. The method of claim 10 wherein the encryption key is generated further in response to a pseudo-random number.

14. A method for use in exchanging information between a first and a second communications devices, the method comprising:

at the first communications device;

determining a first authentication score associated with a first information exchange session between the first and second devices

determining a second authentication score associated with a second information exchange session between the first and second devices, the second information exchange after the first information exchange;

combining the first and second authentication scores to create a combined authentication score;

generating a dynamic pairing code responsive to the combined authentication score;

sending the dynamic pairing code to the second communications device; and

the dynamic pairing code for use by the first and second communications devices in association with one or more of the following, for carrying out subsequent authentication actions, for determining risk associated with exchanging information between the first and second communications devices, for encrypting information, and for assigning access levels to communications devices.

15. The method of claim 14 further comprising encrypting the dynamic pairing code.

16. The method of claim 14 further comprising modifying the cumulative risk analysis score responsive to the occurrence of invalid attempts by an intruder to affect information exchange between the first and the second devices.

17. The method of claim 14 further comprising modifying the cumulative risk analysis score and the dynamic pairing code responsive to an information exchange between the first and second devices following the first and second information exchanges.

18. The method of claim 14 wherein the dynamic pairing code is used to determine a level of trust between the first and second communications devices.

19. The method of claim 14 wherein one of the first and second communications devices comprises an authenticator.