RESILIENT AND RESTORABLE DYNAMIC DEVICE IDENTIFICATION

• US 20140304786A1
• Filed: 04/03/2013
• Published: 10/09/2014
• Est. Priority Date: 04/03/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Yi, Liyu, Chan, Mark, Pei, Mingliang, Ramamurthy, Ajay, Sane, Salil
• Granted Patent: US 9,015,817 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

A computer system receives a request to access a server. The request includes a first device tag set. When the first device tag set matches a previously assigned device tag set, the computer system allows access to the server without requesting full access credentials of a user. The computer system invalidates the first device tag set, and sends a second device tag set. When the first device tag set does not match the previously assigned device tag set, the computer system requests full access credentials from the user.

Claims

1. A method, comprising:

receiving, via a network, a request to access a server, the request comprising a first device tag set;

when the first device tag set matches a previously assigned device tag set,

allowing access to the server without requesting full access credentials of a user,

invalidating the first device tag set, and

sending a second device tag set; and

when the first device tag set does not match the previously assigned device tag set, requesting full access credentials from the user.

2. The method of claim 1, wherein the first device tag set comprises a device tag.

3. The method of claim 2, wherein the device tag comprises a static portion and a dynamic portion, wherein the dynamic portion has a first dynamic value, and wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value.

4. The method of claim 3, wherein invalidating the first device tag set comprises invalidating the first dynamic value of the dynamic portion of the device tag.

5. The method of claim 1, wherein the first device tag set and the second device tag set are part of a sequence of a plurality of device tag sets, and the second device tag set is next in the sequence after the first device tag set.

6. The method of claim 1, wherein:

the first device tag set comprises a plurality of device tags, and

the method further comprises including, in a web page, code that causes each of the plurality of device tags to be placed in a different storage location of a client device, wherein the storage locations of the client device are accessible via an application installed on the client device.

7. The method of claim 6 further comprising:

receiving a location map that indicates a location for each of the plurality of device tags;

when the location map indicates that a first predetermined number of the plurality of device tags are missing from the storage locations, sending the missing device tags; and

when the location map indicates that a second predetermined number of the plurality of device tags are missing from the storage locations, requesting the full access credentials.

8. The method of claim 6 further comprising:

receiving a location map that indicates a location for each of the plurality of device tags; and

when the location map indicates that one of the plurality of device tags is not in an expected storage location, requesting the full access credentials from the user.

9. The method of claim 1 further comprising:

receiving an invalid first device tag set; and

invalidating the second device tag set in view of the received invalid first device tag set.

10. A system, comprising:

a memory; and

a processing device coupled with the memory to;

receive, via a network, a request to access a server, the request comprising a first device tag set;

when the first device tag set matches a previously assigned device tag set, allow access to the server without requesting full access credentials of a user,

invalidate the first device tag set, and

send a second device tag set; and

when the first device tag set does not match the previously assigned device tag set, request full access credentials from the user.

11. The system of claim 10, wherein the first device tag set comprises a device tag.

12. The system of claim 11, wherein the device tag comprises a static portion and a dynamic portion, wherein the dynamic portion has a first dynamic value, and wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value.

13. The system of claim 12, wherein invalidating the first device tag set comprises invalidating the first dynamic value of the dynamic portion of the device tag.

14. The system of claim 12, wherein the first device tag set and the second device tag set are part of a sequence of a plurality of device tag sets, and the second device tag set is next in the sequence after the first device tag set.

15. The system of claim 14, wherein:

the first device tag set comprises a plurality of device tags, and the processing device further to;

include in a web page, code that causes each of the plurality of device tags to be placed in a different storage location of a client device, wherein the storage locations of the client device are accessible via an application installed on the client device.

16. The system of claim 15, the processing device further to:

receive a location map that indicates a location for each of the plurality of device tags;

when the location map indicates that a first predetermined number of the plurality of device tags are missing from the storage locations, send the missing device tags to the client device; and

when the location map indicates that a second predetermined number of the plurality of device tags are missing from the storage locations, request the full access credentials.

17. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

receive, via a network, a request to access a server, the request comprising a first device tag set;

when the first device tag set matches a previously assigned device tag set, allow access to the server without requesting full access credentials of a user,

invalidate the first device tag set, and

send a second device tag set; and

when the first device tag set does not match the previously assigned device tag set, request full access credentials from the user.

18. The non-transitory computer readable storage medium of claim 17, wherein the first device tag set comprises a device tag, wherein the device tag comprises a static portion and a dynamic portion, wherein the dynamic portion has a first dynamic value, and wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value.

19. The non-transitory computer readable storage medium of claim 17, wherein:

the first device tag set comprises a plurality of device tags, and the processing device further to;

include, in a web page, code that causes each of the plurality of device tags to be placed in a different storage location of a client device, wherein the storage locations of the client device are accessible via an application installed on the client device.

20. The non-transitory computer readable storage medium of claim 19, the processing device further to:

receive a location map that indicates a location for each of the plurality of device tags;

when the location map indicates that a first predetermined number of the plurality of device tags are missing from the storage locations, send the missing device tags; and

when the location map indicates that a second predetermined number of the plurality of device tags are missing from the storage locations, request the full access credentials.