Advanced authentication techniques and applications

• US 10,270,748 B2
• Filed: 03/18/2014
• Issued: 04/23/2019
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Briceno, Marc, Wilson, Brendon, Kesanupalli, Ramesh, Baghdasaryan, Davit, Dholakia, Rajiv, Blanke, William J., Lindemann, Rolf, Polivanyi, Igor, Umap, Avinash
• Primary Examiner(s): Agwumezie, Chinedu C
• Application Number:
  US14/218,504
• Publication Number:
  US 20140289833A1
• Time in Patent Office: 1,862 Days
• Field of Search: 705 75
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system, apparatus, method, and machine readable medium are described for performing advanced authentication techniques and associated applications. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.

Claims

1. A location-aware method for user authentication comprising:

receiving, at a client, a request from a user of the client to perform a transaction with a relying party which requires user authentication, the relying party being a website or an online service implemented by one or more computer servers;

receiving, by an authentication engine, environmental sensor data from one or more sensors of the client;

using, by the authentication engine, a geographical location of the client reported by one of the one or more sensors of the client to collect supplemental data known for the geographical location, the supplemental data collected from sources other than the one or more sensors of the client;

collecting, by a client risk assessment agent, client configuration data including at least one of hardware data, operating system data, and application data of the client;

calculating, by an assurance level calculation module, a correlation score based on the client configuration data and a comparison of the environmental sensor data with the supplemental data;

determining, by the assurance level calculation module, an assurance level required for allowing the client to complete the transaction;

determining, by the assurance level calculation module, an assurance level gain required to arrive at the assurance level based on the correlation score; and

selecting, by the authentication engine, one or more authentication techniques to authenticate the user based at least in part on the indication of the assurance level gain.

2. The method of claim 1, wherein the hardware data comprises at least one of client device model, client processor name, client processor type, client boot read-only memory (ROM) version, and management controller version.

3. The method of claim 1, wherein the operating system data comprises at least one of current operating system (OS) version, date of last OS update, and current boot mode.

4. The method of claim 1, wherein the application data comprises at least one of firewall status, firewall type, firewall version, anti-virus software status, anti-virus.