SYSTEMS AND METHODS FOR RECOGNIZING A DEVICE

• US 20190312942A1
• Filed: 06/24/2019
• Published: 10/10/2019
• Est. Priority Date: 02/25/2016
• Status: Active Grant

• Current Assignee: Accertify, Inc. (American Express Company)
• Original Assignee: InAuth, Inc. (American Express Company)
• Inventors: Benson, Glenn S., Marsolan, Paul, Moos, Christopher Guenther
• Granted Patent: US 10,873,641 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system for detecting whether a device seeking communication with a server is a returning device that previously communicated with the server includes a database that stores groups of device attributes based on observable device characteristics and unique identifiers. The database is generally not accessible to the devices. Each attribute group and the associated device identifier (DID) can uniquely identify a particular device, and the associated DID is generally not derivable from the attributes. The database may satisfy a uniqueness property so that each attribute value in the database may also uniquely identify a device.

Claims

1-52. -52. (canceled)

53. A method for identifying a device seeking communication with a server, the method comprising the steps of:

receiving at the server, from the device, device data comprising a plurality of device attributes;

determining by analyzing the device attributes that (i) the device is not classified as a risky device, and that (ii) the plurality of device attributes comprises a key attribute comprising a public key for the device, and a set of other device attributes;

querying a database with the public key;

if the database contains the public key;

accessing from the database a record that corresponds to the public key and comprises a device identifier (DID); and

providing the DID in the record as an identifier of the device;

otherwise;

querying the database with the set of other device attributes;

if the database contains at least one device attribute from the set of other device attributes;

accessing from the database a record that corresponds to the at least one device attribute and comprises a device identifier (DID);

updating the record with the public key for the device;

providing the DID in the record as an identifier of the device;

otherwise;

creating a new DID and a new record comprising the new DID, the public key for the device, and the set of other device attributes;

storing the new record in the database; and

providing the new DID as the identifier of the device.

54. The system of claim 53, wherein the accessed database record comprises a plurality of stored device attributes, the method further comprising:

comparing the set of other device attributes with the stored attributes;

determining that a first attribute from the set of other device attributes fails to match with a corresponding stored attribute; and

updating the corresponding stored attribute with the first attribute.

55. The system of claim 53, wherein creating the new DID comprises generating the new DID using at least one of a random number generator or a pseudo-random number generator.

56. The system of claim 53, wherein the new DID is generated independently of any of the plurality of device attributes.

57. The method of claim 53, wherein a device attribute in the plurality of device attributes is based on at least one of:

a phone number, a mobile equipment identifier, a parameter of an operating system installed on the device, a model number of the device, a serial number of the device, a device characteristic, a public key allocated to the device, or a public key installed on the device.

58. The method of claim 53, wherein the receiving step comprises receiving the device data via a digitally signed message.

59. The method of claim 58, wherein the message comprises:

(i) an information object comprising the plurality of device attributes, (ii) a header object comprising an anti-replay header or an anti-tamper header, and (iii) an integrity object comprising a signature associated with the information object and the header object, the method further comprising;

validating the information object based on the digital signature.

60. The method of claim 59, further comprising:

performing by the server at least one of;

(i) an anti-replay check, or (ii) an anti-tamper check; and

validating the information object according to a result of at least one of;

(i) the anti-replay check, or (ii) the anti-tamper check.

62. The system of claim 53, wherein:

the accessed database record comprises a plurality of stored device attributes; and

the instructions further program the processing unit to;

compare the set of other device attributes with the stored attributes;

determine that a first attribute from the set of other device attributes fails to match with a corresponding stored attribute; and

update the corresponding stored attribute with the first attribute.

63. The system of claim 53, wherein to create the new DID, the instructions program the processing unit to generate the new DID using at least one of a random number generator or a pseudo-random number generator.

64. The system of claim 53, wherein the instructions program the processing unit to generate the new DID independently of any of the plurality of device attributes.

65. The system of claim 53, wherein a device attribute in the plurality of device attributes is based on at least one of:

a phone number, a mobile equipment identifier, a parameter of an operating system installed on the device, a model number of the device, a serial number of the device, a device characteristic, a public key allocated to the device, or a public key installed on the device.

66. The system of claim 53, wherein a digitally signed message comprises the device data being received.

67. The system of claim 66, wherein:

the message comprises;

(i) an information object comprising the plurality of device attributes, (ii) a header object comprising an anti-replay header or an anti-tamper header, and (iii) an integrity object comprising a signature associated with the information object and the header object; and

the instructions further program the processing unit to validate the information object based on the digital signature.

68. The system of claim 67, wherein the instructions further program the processing unit to:

perform least one of;

(i) an anti-replay check, or (ii) an anti-tamper check; and

validate the information object according to a result of at least one of;

(i) the anti-replay check, or (ii) the anti-tamper check.

61. A system for identifying a device seeking communication with a server, the system comprising:

a first processor; and

a first memory in electrical communication with the first processor, the first memory comprising instructions which, when executed by a processing unit included in the server and comprising at least one of the first processor or a second processor, and in electronic communication with a memory module comprising at least one of the first memory or a second memory, program the processing unit to;

receive from the device, device data comprising a plurality of device attributes;

determine by analyzing the device attributes that (i) the device is not classified as a risky device, and that (ii) the plurality of device attributes comprises a key attribute comprising a public key for the device, and a set of other device attributes;

query a database with the public key;

if the database contains the public key;

access from the database a record that corresponds to the public key and comprises a device identifier (DID); and

provide the DID in the record as an identifier of the device;

otherwise;

query the database with the set of other device attributes;

if the database contains at least one device attribute from the set of other device attributes;

access from the database a record that corresponds to the at least one device attribute and comprises a device identifier (DID);

update the record with the public key for the device;

provide the DID in the record as an identifier of the device;

otherwise;

create a new DID and a new record comprising the new DID, the public key for the device, and the set of other device attributes;

store the new record in the database; and

provide the new DID as the identifier of the device.