SYSTEM AND METHOD FOR ADAPTIVE USER AUTHENTICATION

• US 20140289820A1
• Filed: 12/31/2013
• Published: 09/25/2014
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Lindemann, Rolf, Baghdasaryan, Davit
• Granted Patent: US 10,706,132 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication

Abstract

A system, apparatus, method, and machine readable medium are described for adaptive authentication. For example, one embodiment of an apparatus comprises: an adaptive authentication module to receive a client request to perform a transaction which requires authentication; a risk engine to analyze first data related to a client to determine a risk value associated with the client; an assurance level gain analysis module to determine an assurance level required for allowing the client to complete the transaction and to determine an assurance level gain required to arrive at the assurance level based on the risk value; the adaptive authentication module to select one or more authentication techniques based at least in part on the indication of the assurance level gain.

Claims

1. A method comprising:

receiving a client request to perform a transaction which requires authentication;

analyzing first data related to a client to determine a risk value associated with the client;

determining an assurance level required for allowing the client to complete the transaction;

determining an assurance level gain required to arrive at the assurance level based on the risk value;

selecting one or more authentication techniques based at least in part on the indication of the assurance level gain.

2. The method as in claim 1 wherein the operations of determining an assurance level and assurance level gain are performed on a server remote from the client.

3. The method as in claim 1 further comprising:

associating an intrusiveness value with the authentication techniques available on the client;

wherein the one or more authentication techniques are selected based in part on the intrusiveness value associated with the authentication techniques, wherein authentication techniques which are relatively less intrusive but which still result in an acceptable assurance level gain are selected above techniques which are relatively more intrusive.

4. The method as in claim 3 wherein some of the authentication techniques comprise explicit authentication techniques and some of the authentication techniques comprise non-intrusive authentication techniques.

5. The method as in claim 4 wherein the non-intrusive authentication techniques include location-based authentication techniques and/or user behavior detection techniques, and wherein the explicit authentication techniques include biometric authentication modalities including fingerprint, face or speaker authentication and/or user password or personal identification number (PIN) entry.

6. The method as in claim 1 wherein the risk value comprises an implicit assurance level, wherein the assurance level gain added to the implicit assurance level must be sufficient to arrive at the assurance level required for allowing the client to complete the transaction.

7. The method as in claim 1 wherein the operation of selecting one or more authentication techniques based at least in part on the indication of the assurance level gain is performed on a server remote from the client.

8. The method as in claim 1 wherein the operation of selecting one or more authentication techniques based at least in part on the indication of the assurance level gain is performed on the client.

9. The method as in claim 1 wherein the first data related to the client includes an amount of time since a last successful explicit authentication.

10. The method as in claim 9 wherein the first data further includes an indication of a current location and/or user behavior data collected from sensors on the client.

11. The method as in claim 10 wherein current locations known to be visited by a user result in a relatively lower risk value.

12. The method as in claim 11 further comprising:

initially registering one or more locations where the end user performs authentications as specified by the end user; and

determining the risk value based, at least in part, on current distance from the one or more locations specified by the end user.

13. The method as in claim 11 wherein the user behavior data includes gait data associated with the current user, wherein gait data matching a known gait of the user results in a relatively lower risk value.

14. An apparatus comprising:

a risk engine to analyze first data received from a client to determine a risk value associated with the client;

an assurance level gain analysis module to determine an assurance level required for allowing the client to complete the transaction and to determine an assurance level gain required to arrive at the assurance level based on the risk value;

an adaptive authentication module to select one or more authentication techniques based at least in part on the indication of the assurance level gain.

15. The apparatus as in claim 14 wherein the operations of determining an assurance level and assurance level gain are performed on a server remote from the client.

16. The apparatus as in claim 14 further comprising:

the adaptive analysis module associating an intrusiveness value with the authentication techniques available on the client;

wherein the one or more authentication techniques are selected based in part on the intrusiveness value associated with the authentication techniques, wherein authentication techniques which are relatively less intrusive but which still result in an acceptable assurance level gain are selected above techniques which are relatively more intrusive.

17. The apparatus as in claim 16 wherein some of the authentication techniques comprise explicit authentication techniques and some of the authentication techniques comprise non-intrusive authentication techniques.

18. The apparatus as in claim 17 wherein the non-intrusive authentication techniques include location-based authentication techniques and/or user behavior detection techniques, and wherein the explicit authentication techniques include fingerprint authentication and/or user password or personal identification number (PIN) entry.

19. The apparatus as in claim 14 wherein the risk value comprises an implicit assurance level, wherein the assurance level gain added to the implicit assurance level must be sufficient to arrive at the assurance level required for allowing the client to complete the transaction.

20. The apparatus as in claim 14 wherein the adaptive authentication module selecting one or more authentication techniques based at least in part on the indication of the assurance level gain is on a server remote from the client.

21. The apparatus as in claim 14 wherein the adaptive authentication module selecting one or more authentication techniques based at least in part on the indication of the assurance level gain is on the client.

22. The apparatus as in claim 14 wherein the first data related to the client includes an amount of time since a last successful explicit authentication.

23. The apparatus as in claim 22 wherein the first data further includes an indication of a current location and/or user behavior data collected from sensors on the client.

24. The apparatus as in claim 23 wherein current locations known to be visited by a user result in a relatively lower risk value.

25. The apparatus as in claim 24 wherein one or more locations where the end user performs authentications are initially specified by the end user;

and wherein the risk value is determined, at least in part, on current distance from the one or more locations specified by the end user.

26. The apparatus as in claim 24 wherein the user behavior data includes gait data associated with the current user, wherein gait data matching a known gait of the user results in a relatively lower risk value.