Context sensitive dynamic authentication in a cryptographic system

• US 8,214,650 B2
• Filed: 09/09/2010
• Issued: 07/03/2012
• Est. Priority Date: 09/20/1999
• Status: Expired due to Fees

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Dickinson, Alexander G., Berger, Brian, Dobson, Robert T. Jr.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US12/878,317
• Publication Number:
  US 20110004933A1
• Time in Patent Office: 663 Days
• Field of Search: 726/8, 713/182
• US Class Current: 713/182
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

A system for performing authentication of a first user to a second user includes the ability for the first user to submit multiple instances of authentication data which are evaluated and then used to generate an overall level of confidence in the claimed identity of the first user. The individual authentication instances are evaluated based upon: the degree of match between the user provided by the first user during the authentication and the data provided by the first user during his enrollment; the inherent reliability of the authentication technique being used; the circumstances surrounding the generation of the authentication data by the first user; and the circumstances surrounding the generation of the enrollment data by the first user. This confidence level is compared with a required trust level which is based at least in part upon the requirements of the second user, and the authentication result is based upon this comparison.

Claims

1. A method of performing graded authentication of a user wherein the method obtains and evaluates circumstantial data associated with an authentication attempt, the method comprising:

obtaining user data from a user during an authentication attempt;

obtaining circumstantial data associated with the authentication attempt; and

determining a level of trust associated with the authentication attempt based on the comparison of the circumstantial data with previously stored data,

wherein the circumstantial data comprises a time stamp associated with the time at which the user data was obtained.

2. A method as in claim 1 wherein said act of determining the level of trust associated with the authentication attempt is further based on the comparison of the user data with previously stored data.

3. A method as in claim 1 wherein the previously stored data comprises in part a historical record of the circumstantial data obtained during previous successful authentications for the user.

4. A method as in claim 1 wherein the circumstantial data comprises an identification associated with the system from which the user data is obtained.

5. A method as in claim 4 wherein the identification comprises a processor serial number.

6. A method as in claim 1 wherein the circumstantial data comprises an identification associated with the network location of the system from which the user data is obtained.

7. A method as in claim 6 wherein the identification comprises an IP address.

8. A method as in claim 1 wherein the circumstantial data comprises an identifier representing the medium over which the user data is obtained.

9. A method as in claim 1 wherein the circumstantial data represents more than one circumstantial aspect of the authentication attempt.

10. A method as in claim 9 wherein the circumstantial data comprises a time stamp associated with the time at which the user data was obtained and an identification associated with the network location of the system from which the user data is obtained.

11. A method for authenticating a user comprising:

obtaining user data associated with an authentication operation;

obtaining metadata related to the authentication operation;

comparing the metadata with previously stored data; and

determining a level of trust associated with the authentication operation,

wherein the act of determining a level of trust associated with the authentication operation comprises assigning a percentage to the authentication operation which represents a degree of confidence in the authentication of the user.

12. A method as in claim 11 wherein the user data associated with the authentication operation represents the intent of a user to assent to a transaction.

13. A method as in claim 12 wherein the metadata related to the authentication operation are made available at a later time to contest a repudiation of the authentication operation by the user.

14. A method for authenticating a user comprising:

obtaining user data associated with an authentication operation;

obtaining metadata related to the authentication operation;

comparing the metadata with previously stored data; and

determining a level of trust associated with the authentication operation;

determining an intermediate level of trust associated with the metadata based upon the comparison of the metadata with previously stored data,

wherein the act of determining an intermediate level of trust comprises assigning a percentage to the metadata which represents the degree of correspondence between the metadata and the previously stored data.

15. A method as in claim 14 wherein the act of determining a level of trust associated with the authentication operation comprises multiplying the percentage representing the intermediate level of trust and a percentage which represents a degree of correspondence between the user data and the previously stored data.

16. A method as in claim 15 wherein additional factors are used to weight the percentage representing the intermediate level of trust and the percentage which represents the degree of correspondence between the user data and the previously stored data differently.

17. A method for authenticating a user comprising:

obtaining user data associated with an authentication operation;

obtaining metadata related to the authentication operation; and

determining a level of trust associated with the authentication operation based on the metadata,

wherein the act of determining a level of trust compares the metadata with previously stored data and the metadata comprises a time stamp associated with the time at which the user data was obtained.

18. A method as in claim 17 further comprising providing the user with a plurality of authentication techniques which may be used to generate the user data.

19. A method as in claim 18 wherein the user data is generated using more than one of the plurality of authentication techniques.

20. A method as in claim 19 wherein the user data generated using each authentication technique is compared with a different portion of a set of previously stored data.

21. A method of performing graded authentication of a user wherein the method obtains and evaluates circumstantial data associated with an authentication attempt, the method comprising:

obtaining user data from a user during an authentication attempt;

obtaining circumstantial data associated with the authentication attempt; and

determining a level of trust associated with the authentication attempt based on the comparison of the circumstantial data with previously stored data,

wherein the act of determining a level of trust associated with the authentication attempt comprises assigning a percentage to the authentication attempt which represents a degree of confidence in the authentication of the user.

22. A method as in claim 21 wherein said act of determining the level of trust associated with the authentication attempt is further based on the comparison of the user data with the previously stored data.

23. A method as in claim 21 wherein the previously stored data comprises in part a historical record of the circumstantial data obtained during previous successful authentications for the user.

24. A method as in claim 21 wherein the circumstantial data comprises an identification associated with the system from which the user data is obtained.

25. A method as in claim 24 wherein the identification comprises a processor serial number.

26. A method as in claim 21 wherein the circumstantial data comprises an identification associated with the network location of the system from which the user data is obtained.

27. A method as in claim 26 wherein the identification comprises an IP address.

28. A method as in claim 21 wherein the circumstantial data comprises an identifier representing the medium over which the user data is obtained.

29. A method as in claim 21 wherein the circumstantial data represents more than one circumstantial aspect of the authentication attempt.

30. A method as in claim 29 wherein the circumstantial data comprises a time stamp associated with the time at which the user data was obtained and an identification associated with the network location of the system from which the user data is obtained.

31. A method of performing graded authentication of a user wherein the method obtains and evaluates circumstantial data associated with an authentication attempt, the method comprising:

obtaining user data from a user during an authentication attempt;

obtaining circumstantial data associated with the authentication attempt; and

determining an intermediate level of trust associated with the authentication attempt based on the comparison of the metadata with previously stored data, wherein the act of determining the intermediate level of trust comprises assigning a percentage to the metadata which represents the degree of correspondence between the metadata and the previously stored data.

32. A method as in claim 31 wherein said act of determining the intermediate level of trust associated with the authentication attempt is further based on the comparison of the user data with the previously stored data.

33. A method as in claim 31 wherein the previously stored data comprises in part a historical record of the circumstantial data obtained during previous successful authentications for the user.

34. A method as in claim 31 wherein the circumstantial data comprises an identification associated with the system from which the user data is obtained.

35. A method as in claim 34 wherein the identification comprises a processor serial number.

36. A method as in claim 31 wherein the circumstantial data comprises an identification associated with the network location of the system from which the user data is obtained.

37. A method as in claim 36 wherein the identification comprises an IP address.

38. A method as in claim 31 wherein the circumstantial data comprises an identifier representing the medium over which the user data is obtained.

39. A method as in claim 31 wherein the circumstantial data represents more than one circumstantial aspect of the authentication attempt.

40. A method as in claim 39 wherein the circumstantial data comprises a time stamp associated with the time at which the user data was obtained and an identification associated with the network location of the system from which the user data is obtained.

41. A method for authenticating a user comprising:

obtaining user data associated with an authentication operation;

obtaining metadata related to the authentication operation; and

determining a level of trust associated with the authentication operation based on the metadata,

wherein the act of determining a level of trust associated with the authentication operation comprises assigning a percentage to the authentication operation which represents the degree of confidence in the authentication of the user.

42. A method as in claim 41 wherein the act of determining a level of trust compares the metadata with previously stored data.

43. A method as in claim 41 further comprising providing the user with a plurality of authentication techniques which may be used to generate the user data.

44. A method as in claim 43 wherein the user data is generated using more than one of the plurality of authentication techniques.

45. A method as in claim 44 wherein the user data generated using each authentication technique is compared with a different portion of a set of previously stored data.

46. A method for authenticating a user comprising:

obtaining user data associated with an authentication operation;

obtaining metadata related to the authentication operation; and

determining a level of trust associated with the authentication operation based on the metadata,

determining an intermediate level of trust associated with the metadata based upon the comparison of the metadata with previously stored data,

wherein the act of determining an intermediate level of trust comprises assigning a percentage to the metadata which represents the degree of correspondence between the metadata and the previously stored data.

47. A method as in claim 46 wherein the act of determining a level of trust compares the metadata with previously stored data.

48. A method as in claim 46 further comprising providing the user with a plurality of authentication techniques which may be used to generate the user data.

49. A method as in claim 48 wherein the user data is generated using more than one of the plurality of authentication techniques.

50. A method as in claim 49 wherein the user data generated using each authentication technique is compared with a different portion of a set of previously stored data.