DEVICE IDENTIFICATION BASED ON DEEP FINGERPRINT INSPECTION

• US 20160155128A1
• Filed: 12/02/2014
• Published: 06/02/2016
• Est. Priority Date: 12/02/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: DESAI, SURIL, Narayanan, Swaminathan, Rai, Akash
• Granted Patent: US 9,984,365 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

A method of identifying a device includes receiving a device transaction request from a remote device, receiving a first device fingerprint of the remote device, and receiving a second device fingerprint of a known device. The first device fingerprint is compared with the second device fingerprint and a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint is generated. A third device fingerprint corresponding to an expected current value of the second device fingerprint is generated, and the first device fingerprint is compared with the third device fingerprint to generate a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint. A response to the transaction request is formulated based on the first metric and the second metric.

Claims

1. A method of identifying a device, comprising:

receiving, at a transaction server, a device transaction request from a remote device;

receiving a first device fingerprint of the remote device;

receiving a second device fingerprint of a known device;

comparing the first device fingerprint with the second device fingerprint and responsively generating a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint;

generating a third device fingerprint, the third device fingerprint comprising an expected current value of the second device fingerprint;

comparing the first device fingerprint with the third device fingerprint and responsively generating a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint; and

generating a response to the transaction request based on the first metric and the second metric.

2. The method of claim 1, wherein the known device comprises a known good device, and wherein the response to the transaction request comprises authorizing the transaction based on the second metric.

3. The method of claim 1, wherein the known device comprises a known fraud device, and wherein the response to the transaction request comprises rejecting the transaction based on the second metric.

4. The method of claim 1, wherein the response to the transaction request comprises requesting additional authentication data from the remote device in response to the first and second metrics indicating that the first device fingerprint does not match the second or third device fingerprints.

5. The method of claim 1, wherein the second device fingerprint comprises an operating system version level, and wherein generating the third device fingerprint comprises:

determining that a more recent version level of the operating system is available;

updating the operating system version level to the more recent version level; and

storing the updated operating system version level in the third device fingerprint.

6. The method of claim 1, wherein the second device fingerprint comprises an application software version level, and wherein generating the third device fingerprint comprises:

updating the application software version level to a recent software version level and storing the application software version level in the third device fingerprint.

7. The method of claim 6, wherein updating the application software version level comprises:

retrieving an update history associated with the second device fingerprint; and

updating the application software version level based on the update history associated with the second device fingerprint.

8. The method of claim 1, further comprising:

analyzing an internal consistency of the first device fingerprint; and

generating a third metric indicative of the internal consistency of the first device fingerprint.

9. The method of claim 8, wherein analyzing the internal consistency of the first device fingerprint comprises:

receiving hardware and software version information associated with the first device; and

comparing the hardware and software version information to determine if they are compatible.

10. The method of claim 8, wherein analyzing the internal consistency of the first device fingerprint comprises:

receiving hardware version information associated with the first device;

determining a clock speed of the first device; and

determining if the clock speed of the first device is consistent with the hardware version information associated with the first device.

11. The method of claim 8, wherein analyzing the internal consistency of the first device fingerprint comprises:

receiving a reported time zone associated with the first device;

receiving geolocation information for the first device; and

determining if the reported time zone information of the first device is consistent with the geolocation information for the first device.

12. The method of claim 8, wherein analyzing the internal consistency of the first device fingerprint comprises:

receiving network information associated with the first device; and

comparing the network information to determine if the network information associated with the device is compatible with the device.

13. A method of identifying a device, comprising:

receiving a device transaction request from a remote device;

receiving a first device fingerprint of the remote device;

determining if the first device fingerprint matches any of a first plurality of device fingerprints of known good devices;

if the first device fingerprint does not match any of the plurality of device fingerprints of known good devices, determining if the first device fingerprint matches any of a second plurality of device fingerprints of known fraud devices or if the first device fingerprint matches an expected modification of any of the second plurality of device fingerprints of known fraud devices; and

if the first device fingerprint matches any of the second plurality of device fingerprints or an expected modification of any of the second plurality of device fingerprints, rejecting the transaction or requiring additional verification before proceeding with the transaction.

14. The method of claim 13, further comprising:

if the first device fingerprint matches one of the first plurality of device fingerprints, determining if the first device fingerprint matches an expected modification of the one of the first plurality of device fingerprints;

if the first device fingerprint does not match the expected modification of the one of the first plurality of device fingerprints, rejecting the transaction or requiring additional verification before proceeding with the transaction; and

if the first device fingerprint matches an expected modification of the one of the first plurality of device fingerprints, authorizing the transaction.

15. The method of claim 13, further comprising:

if the first device fingerprint does not match any of the second plurality of device fingerprints and does not match an expected modification of any of the second plurality of device fingerprints, determining of the first device fingerprint is a plausible device fingerprint; and

if the first device fingerprint is a plausible device fingerprint, authorizing the transaction.

16. The method of claim 15, further comprising, if the first device fingerprint is not a plausible device fingerprint, rejecting the transaction or requiring additional verification before proceeding with the transaction.

17. A transaction server comprising:

a processing unit; and

a memory comprising a fingerprint analysis module;

wherein the transaction server receives a device transaction request from a remote device, receives a first device fingerprint of the remote device, and receives a second device fingerprint of a known device; and

wherein the fingerprint analysis module comprises computer program instructions that compare the first device fingerprint with the second device fingerprint and responsively generate a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint, generate a third device fingerprint, the third device fingerprint comprising an expected current value of the second device fingerprint, compare the first device fingerprint with the third device fingerprint and responsively generate a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint; and

wherein the transaction server generates a response to the transaction request based on the first metric and the second metric.

18. The transaction server of claim 17, wherein the known device comprises a known good device, and wherein the response to the transaction request comprises proceeding with the transaction in response to second metric indicating that the first device fingerprint matches the third device fingerprint.

19. The transaction server of claim 17, wherein the known device comprises a known fraud device, and wherein the response to the transaction request comprises rejecting the transaction in response to second metric indicating that the first device fingerprint matches the third device fingerprint.

20. The transaction server of claim 17, wherein the response to the transaction request comprises requesting additional authentication data from the remote device in response to the first and second metrics indicating that the first device fingerprint does not match the second or third device fingerprints.