SYSTEM AND METHOD FOR LOCATION-BASED AUTHENTICATION

• US 20140289821A1
• Filed: 12/31/2013
• Published: 09/25/2014
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Wilson, Brendon J.
• Granted Patent: US 9,305,298 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication

Abstract

A system, apparatus, method, and machine readable medium are described for location-aware authentication. For example, one embodiment of a location-aware method for user authentication comprises: determining a current location of a mobile device; identifying a location class corresponding to the current location; selecting a set of one or more authentication techniques to provide a sufficient level of user authentication for a current transaction based on the identified location class.

Claims

1. A location-aware method for user authentication comprising:

determining a current location of a mobile device;

identifying a location class corresponding to the current location;

receiving an authentication policy associated with a particular relying party, the authentication policy defining a set of one or more authentication techniques to provide a sufficient level of user authentication for a current transaction based on the identified location class; and

selecting from the set of one or more authentication techniques to authenticate the user for the current transaction based on the identified location class.

2. The method as in claim 1 wherein determining a current location comprises using a global positioning system (GPS) device.

3. The method as in claim 1 wherein determining a current location comprises performing a reverse lookup of the mobile device'"'"'s IP address.

4. The method as in claim 1 wherein determining a current location comprises performing cell tower triangulation and/or Wifi access point triangulation.

5. The method as in claim 1 wherein determining a current location comprises performing an approximation by noting a change in the mobile device'"'"'s position relative to a starting point with a known location.

6. The method as in claim 1 wherein determining a current location comprises:

detecting the presence of one or more peer or network infrastructure devices; and

performing a correlation against historical presence data for the peer or network infrastructure devices, wherein a relatively higher correlation indicates that the mobile device is at a known location and a relatively lower correlation indicates that the mobile device is not at a known location.

7. The method as in claim 1 wherein at least one location class is defined as the mobile device being within a given radius of a known specified location.

8. The method as in claim 1 wherein at least one location class is defined as the mobile device being within a specified boundary region or outside of a specified boundary region.

9. The method as in claim 1 wherein the authentication techniques which may be selected include explicit authentication techniques and non-intrusive authentication techniques.

10. The method as in claim 9 wherein the explicit authentication techniques include one or more of fingerprint authentication, voice or facial recognition, retinal scanning, and PIN entry by the end user.

11. The method as in claim 9 wherein the non-intrusive authentication techniques include authentication based on data collected from one or more user behavior sensors.

12. The method as in claim 11 wherein the user behavior sensors measure a gait of the user, wherein the user is non-intrusively authenticated based on the user'"'"'s gait being detected.

13. The method as in claim 9 wherein the non-intrusive authentication techniques include detecting presence of one or more peer or network infrastructure devices known to be present at a particular location.

14. A location-aware system for user authentication comprising:

a location detection module to determine a current location of a mobile device;

a location class determination module to identify a location class corresponding to the current location;

an authentication policy engine to receive an authentication policy associated with a particular relying party, the authentication policy defining a set of one or more authentication techniques to provide a sufficient level of user authentication for a current transaction based on the identified location class, the authentication policy engine to select from the set of one or more authentication techniques to authenticate the user for the current transaction based on the identified location class.

15. The system as in claim 14 wherein the location detection module comprises a global positioning system (GPS) device.

16. The system as in claim 14 wherein determining a current location comprises performing a reverse lookup of the mobile device'"'"'s IP address.

17. The system as in claim 14 wherein determining a current location comprises performing cell tower triangulation and/or Wifi access point triangulation.

18. The system as in claim 14 wherein determining a current location comprises performing an approximation by noting a change in the mobile device'"'"'s position relative to a starting point with a known location.

19. The system as in claim 14 further comprising:

a device proximity detection module to detect the presence of one or more peer or network infrastructure devices and to perform a correlation against historical presence data for the peer or network infrastructure devices, wherein a relatively higher correlation indicates that the mobile device is at a known location and a relatively lower correlation indicates that the mobile device is not at a known location.

20. The system as in claim 14 wherein at least one location class is defined as the mobile device being within a given radius of a known specified location.

21. The system as in claim 14 wherein at least one location class is defined as the mobile device being within a specified boundary region or outside of a specified boundary region.

22. The system as in claim 14 wherein the authentication techniques which may be selected include explicit authentication techniques and non-intrusive authentication techniques.

23. The system as in claim 22 wherein the explicit authentication techniques include one or more of fingerprint authentication, voice or facial recognition, retinal scanning, and PIN entry by the end user.

24. The system as in claim 22 wherein the non-intrusive authentication techniques include authentication based on data collected from one or more user behavior sensors.

25. The system as in claim 24 wherein the user behavior sensors measure a gait of the user, wherein the user is non-intrusively authenticated based on the user'"'"'s gait being detected.

26. The system as in claim 22 wherein the non-intrusive authentication techniques include detecting presence of one or more peer or network infrastructure devices known to be present at a particular location.