SYSTEM AND METHOD FOR VERIFYING STATUS OF AN AUTHENTICATION DEVICE THROUGH A BIOMETRIC PROFILE

• US 20150046990A1
• Filed: 08/08/2014
• Published: 02/12/2015
• Est. Priority Date: 08/08/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Granted Patent: US 9,053,310 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A system and method that includes receiving a first biometric profile and associating the first biometric profile with a first application instance that is assigned as an authentication device of a first account; receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account; comparing the second biometric profile to the first biometric profile; and completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile.

Claims

1. The inventions as shown and/or described.

enrolling a first device instance as an authentication device of a first account in a multi-factor authentication factor system;

at the first device instance, collecting a reference biometric profile;

transmitting the reference biometric profile to the multi-factor authentication system;

at the multi-factor authentication factor system, associating the reference biometric profile with the first account;

initiating enrollment of a second device instance of the first account;

at the second device instance, collecting a second biometric profile;

transmitting the second biometric profile to the multi-factor authentication system;

comparing the second biometric profile to the reference biometric profile associated with the first account; and

completing the enrollment of the second device instance enrollment according to a result of the comparison of the second biometric profile and the reference biometric profile.

2. The method of claim 1, wherein enrolling a first device instance comprises establishing a set of authentication credentials for a set of accounts on the first device instance;

and wherein completing the enrollment of the second device instance comprises, when the second biometric profile is confirmed to correspond to the reference biometric profile, establishing a second set of authentication credentials for the set of accounts on the second device instance.

3. The method of claim 2, wherein the second set of credentials is a copy of the first set of credentials stored at the multi-factor authentication system.

4. The method of claim 2, further comprising updating the first set of credentials used by the first device instance at least one time after enrollment.

5. The method of claim 2, wherein completing the enrollment of the second device instance comprises invalidating the authentication credentials of the first device.

6. The method of claim 2, wherein completing the enrollment of the second device instance enrollment according to the result of the comparison of the second biometric profile and the reference biometric profile comprises, when the second biometric profile is confirmed to not correspond to the reference biometric profile, rejecting enrollment of the second device instance.

7. The method of claim 1, wherein the first device instance is a different physical device from the second device instance.

8. The method of claim 1, wherein the first device instance is a first application installation instance on a first physical device, and the second device instance is a second application installation instance on the first physical device.

9. The method of claim 8, wherein the first application installation is a different installation of the same application as the second application installation.

10. The method of claim 8, wherein the second device installation instance corresponds to an application instance with at least partially cleared authentication credentials.

11. The method of claim 1, further comprising collecting an updated biometric profile at time after initially collecting the reference biometric profile;

and updating the reference biometric profile associated with the first account.

12. The method of claim 1, wherein a biometric profile additionally embeds knowledge-based factor of authentication information;

and wherein comparing the second biometric profile to the reference biometric profile associated with the first account further comprises comparing the knowledge-based factor of authentication information embedded in the second biometric profile to the reference biometric profile.

13. The method of claim 12, wherein collecting the reference biometric profile and the second biometric profile is a collected audio recording of a spoken pass phrase.

14. The method of claim 1, wherein the reference and second biometric profiles are audio biometric profiles.

15. The method of claim 1, wherein the reference and second biometric profiles are image-based biometric profiles.

16. The method of claim 1, wherein the reference and second biometric profiles are fingerprint biometric profiles.

17. The method of claim 1, wherein the reference and second biometric profiles is a combination of at least heart rate, blood pressure, and body temperature.

18. A method comprising:

receiving a first biometric profile and associating the first biometric profile with a first application instance that is assigned as an authentication device of a first account;

receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account;

comparing the second biometric profile to the first biometric profile; and

completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile.

19. The method of claim 18, further comprising:

establishing a first set of authentication credentials for a set of accounts on the first application instance;

wherein the request of the second application instance is to enroll the second application instance as an authentication application of the first account; and

wherein completing the request of the second application instance comprises if the second biometric profile satisfies a condition of matching the first biometric profile when compared, establishing a second set of authentication credentials for the set of accounts on the second application instance.

20. The method of claim 19, wherein the first application instance is on a different physical device from the second application instance.

21. The method of claim 18, wherein the request of the second application instance is a request to verify multi-factor authentication of the first account;

and wherein completing the request of the second application instance comprises if the second biometric profile satisfies a condition of matching the first biometric profile when compared, verifying multi-factor authentication of the user.

22. The method of claim 21, wherein the first application instance is the same application instance as the second application instance.

23. The method of claim 18, wherein the first and second biometric profiles are audio biometric profiles.

24. The method of claim 23 wherein an audio biometric profile additionally embeds knowledge-based pass phrase information;

and wherein comparing the second biometric profile to the first biometric profile associated with the first account further comprises comparing an embedded pass phrase of the second biometric to an embedded pass phrase of the first biometric profile.

25. The method of claim 18, wherein the first and second biometric profiles are image-based biometric profiles.

26. The method of claim 18, wherein the first and second biometric profiles are fingerprint biometric profiles.