Method for adaptive authentication using a mobile device

• US 8,646,060 B1
• Filed: 07/30/2013
• Issued: 02/04/2014
• Est. Priority Date: 07/30/2013
• Status: Active Grant

• Current Assignee: Optima Direct, LLC (2S Ventures, LLC)
• Original Assignee: Mourad Ben Ayed
• Inventors: Ben Ayed, Mourad
• Primary Examiner(s): Pearson, David
• Application Number:
  US13/954,633
• Time in Patent Office: 189 Days
• Field of Search: None
• US Class Current: 726/9
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel

Abstract

A method for facilitating login using adaptive authentication. The method uses different authentication methods and different data protection methods depending on the user location, availability of network, importance of the data.

Claims

1. A method for adaptive authentication comprising:

initiating a transaction onboard a first terminal,

whereby the first terminal obtains a user identifier using a method selected from the group consisting of;

wireless scan of a user'"'"'s device,

scan a bar code,

obtain an identifier from a user,

obtain an identifier from memory,

obtain an identifier from a database, and

user profiling,

wherein the first terminal posts an authentication request to a remote server,

wherein the authentication request corresponds to a user identifier,

wherein the authentication request comprises at least one transaction information item,

wherein the first terminal can obtain policy information from a remote server,

wherein the first terminal is selected from the group consisting of;

a mobile device, a computing device, a television set, a point of sale terminal, and a physical access terminal;

running an authentication program onboard a first mobile device,

wherein the authentication program corresponds to the user identifier,

wherein the authentication program can login to the remote server,

wherein the authentication program stores at least one first digital key selected from the group consisting of;

a password, a random key, a one-time-password generator, a certificate, a Private Key Infrastructure (PKI) key, a symmetric key, an asymmetric key, payment information, access information, and physical access code,

wherein the at least one first digital key can be stored in a secure memory location or on a secure element onboard the first mobile device,

wherein the first mobile device is distinct from the first terminal,

wherein upon detecting a user action onboard the first mobile device,

wherein the user action is selected from the group consisting of;

a button push, a display touch, a motion, a spoken word, and an application brought to the foreground,

if the authentication program obtains a pending authentication request wirelessly from the remote server,

wherein the pending authentication request corresponds to the user identifier,

the authentication program can display the at least one transaction information,

the authentication program initiates a user authentication action onboard the first mobile device and uses a user authentication method selected from the group consisting of;

verify a button is activated or a menu is selected or a display is touched or an application is brought to the foreground,

authenticate a pass code,

authenticate a response to a challenge question,

and authenticate biometric information,

wherein the user authentication method is different from a previously used user authentication method,

wherein upon or after a successful user authentication,

the authentication program posts an authentication information update to the remote server,

 

wherein the authentication information update corresponds to the pending authentication request,

 

wherein the authentication information update comprises the at least one first digital key or at least one second digital key corresponding to the at least one first digital key;

whereby after a pre-determined period of time,

if the first terminal retrieves an authentication information update corresponding to the authentication request,

the first terminal uses the authentication information update to perform an action selected from the group consisting of;

unlock, uncloak, decrypt data, login to an application, authenticate to a remote server, authorize a second transaction, transmit user information wirelessly to a separate terminal, login automatically to an application interface, and call a script.

2. The method of claim 1 whereby:

the first terminal posts confirmation information corresponding to the transaction to the remote server,

the authentication program retrieves the confirmation information,

the authentication program displays the confirmation information.

3. The method of claim 1 whereby:

if the distance between the current location of the first mobile device and the current location of the first terminal is above a threshold,

the transaction is not authorized;

the first terminal can periodically post verification requests to the remote server,

wherein if the first terminal does not obtain an update corresponding to a verification request,

the first terminal can perform an action selected from the group consisting of;

lock, cloak, cancel, reject, and encrypt data.

4. The method of claim 1 comprising:

if the first mobile device detects motion or acceleration signals that are above a pre-determined threshold,

an application onboard the first terminal performs an action selected from the group consisting of;

lock, cloak, close, and encrypt data;

wherein the motion signals are captured using an accelerometer or a tilt detector onboard the first mobile device.

5. The method of claim 1 whereby:

the authentication program obtains sensor information from sensors located onboard the first mobile device,

wherein the sensor information is selected from the group consisting of;

current location information, acceleration information, gyration information, tilt information, WIFI networks in view information, radio frequency networks in view information, radio frequency signal strength information, lighting level information, audio level information, and temperature information,

wherein the authentication program can post the sensor information to the remote server,

wherein if the sensor information does not match at least one pre-determined policy, the authentication program can perform an action selected from the group consisting of;

abort operation, block response, lock, exist, cloak, cancel the current transaction, and encrypt data;

whereby if the location of the first terminal is within a pre-determined distance from a predetermined location or if the first terminal is connected to a trusted WIFI network or if the current transaction amount is below a pre-determined threshold,

the user authentication method can be selected from the group consisting of;

verify a button is activated, verify a menu is selected, verify a display is touched, and verify GP an application is brought to the foreground;

whereby if the location of the first terminal is outside pre-determined areas or if the first terminal is outside a pre-determined WIFI coverage areas or if the current transaction amount is above a pre-determined threshold,

the user authentication method can be selected from the group consisting of;

authenticate a pass code, and

authenticate a response to a challenge question;

whereby if the first terminal is not connected to any 3 G or WIFI network or if the transaction matches a pre-determined condition,

the user authentication method can be selected from the group consisting of;

authenticate biometric information, and

verify that both the first mobile device and a second mobile device authorized the transaction,

wherein the second mobile device is distinct from the first mobile device.

6. The method of claim 1 comprising:

if the current location is within a pre-determined distance from a pre-defined location or if a pre-determined WIFI network is detected,

the authentication program does not request a pass code;

if the current location is not within a pre-determined distance from a known location,

the authentication program requests a pass code;

if the first terminal is not connected to any data network or if the current location is outside a pre-determined area or if the current transaction matches a pre-determined risk profile,

the authentication program can request biometric information;

whereby after a user is logged in to an application,

if the current location is within a pre-determined distance from a pre-defined location or if a pre-determined WIFI network is detected,

the application locks after a first pre-determined period of inactivity;

if the current location is not within a pre-determined distance from a known location,

the application locks after a second pre-determined period of inactivity,

wherein the second pre-determined period of inactivity can be different from the first pre-determined period of inactivity.

7. The method of claim 1 comprising:

obtaining authentication policies corresponding to information selected from the group consisting of;

the current location information of the first mobile device, the current location information of the first terminal, connected WIFI, sensed radiofrequency signals, a transaction information, the current time of day, a user profile, an application profile, a transaction profile, and a device profile;

if the authentication policies indicate pass code verification,

the authentication program requests a pass code,

if the authentication policies indicate biometric verification,

the authentication program requests biometric information.

8. The method of claim 1 comprising:

the first terminal posting an authentication code to the remote server,

wherein if the authentication code indicates user action verification,

the authentication program verifies a button is activated or a menu is selected or a display is touched or an application is brought to the foreground,

if the authentication code indicates pass code verification,

the authentication program requests a pass code,

if the authentication code indicates biometric verification,

the authentication program can request biometric information.

9. The method of claim 1 comprising:

the first terminal obtaining a digital key from the authentication information update,

the first terminal decrypting user information using the digital key,

the first terminal using the decrypted user information to perform an action selected from the group consisting of;

login to a user account, fill a form, execute a payment transaction, unlock, and decrypt data.

10. The method of claim 1 whereby:

the user authentication method comprises verification of biometric information,

wherein the biometric information is selected from the group consisting of;

voice authentication, voice authentication challenge, handwriting authentication challenge, fingerprint authentication, iris authentication, and facial authentication.

11. The method of claim 1 comprising:

displaying a first challenge question,

wherein the first challenge question is different from a previously displayed challenge question;

obtaining a response to the first challenge question selected from the group consisting of;

voice response, text response, and gesture response;

whereby the response is authenticated using a reference answer set corresponding to the first challenge question,

wherein the reference answer set is stored onboard the first terminal or the first mobile device,

wherein if a match is found,

the transaction is authorized.

20. The methods of claim 1, 12, or 13 comprising:

injecting object code that provides adaptive authentication in an application executable.

12. A method for adaptive authentication comprising:

initiating a transaction onboard a first terminal,

whereby the first terminal posts an authentication request to a remote server,

wherein the authentication request corresponds to a user identifier;

running an authentication program onboard a first mobile device,

wherein the authentication program corresponds to the user identifier,

wherein the authentication program stores at least one first digital key onboard the first mobile device,

wherein upon detecting a user action onboard the first mobile device,

if the authentication program obtains a pending authentication request wirelessly from the remote server,

wherein the pending authentication request corresponds to the user identifier,

the authentication program can display the transaction information,

the authentication program initiates a user authentication action onboard the first mobile device and uses a user authentication method selected from the group consisting of;

verify a button is activated or a menu is selected or a display is touched or an application is brought to the foreground,

authenticate a pass code,

authenticate a response to a challenge question,

authenticate biometric information, and

verify that both the first mobile device and a second mobile device authorized the first transaction,

 

wherein the second mobile device is distinct from the first mobile device,

wherein the user authentication method is different from a previously used user authentication method,

wherein upon or after a successful user authentication,

 

the authentication program posts an authentication information update to the remote server,

 

wherein the authentication information update corresponds to the pending authentication request,

 

wherein the authentication information update comprises the at least one first digital key or at least one second digital key corresponding to the at least one first digital key;

whereby after a pre-determined period of time,

if the first terminal retrieves an authentication information update corresponding to the authentication request,

the first terminal uses the authentication information update to perform an action selected from the group consisting of;

 

unlock, uncloak, decrypt data, login to an application, authenticate to a remote server, authorize a second transaction, transmit user information wirelessly to a separate terminal, login automatically to an application interface, and call a script.

13. A method for adaptive authentication comprising:

initiating a first transaction onboard a first terminal,

whereby the first terminal can obtain a token identifier either from memory, from a remote database, or by scanning devices using short wireless communication,

whereby the first terminal can obtain policy information from a remote server,

whereby the first terminal sends a authentication request wirelessly to a first mobile device,

wherein the authentication request can comprise the transaction information,

wherein the first mobile device corresponds to the token identifier;

running an authentication program onboard a first mobile device,

wherein the authentication program stores at least one first digital key selected from the group consisting of;

a password, a random key, a one-time-password generator, a certificate, a Private Key Infrastructure (PKI) key, a symmetric key, an asymmetric key, payment information, access information, and physical access code,

wherein the at least one first digital key can be stored in a secure memory location or on a secure element onboard the first mobile device,

wherein the first mobile device is distinct from the first terminal;

whereby after receipt of a wireless response from the mobile device,

wherein the wireless response comprises at least one second digital key corresponding to the at least one first digital key,

the first terminal initiates a user authentication action and uses a user authentication method selected from the group consisting of;

verify a button is activated or a menu is selected or a display is touched or an application is brought to the foreground,

authenticate a pass code,

authenticate a response to a challenge question,

authenticate biometric information, and

verify that both the first mobile device and a second mobile device authorized the transaction,

wherein the second mobile device is distinct from the first mobile device,

wherein the user authentication method is different from a previously used user authentication method;

wherein upon or after a successful user authentication,

the first terminal uses the at least one second digital key to perform an action selected from the group consisting of;

unlock, uncloak, decrypt data, login to an application, authenticate to a remote server, authorize a second transaction, transmit user information wirelessly to a separate terminal, login automatically to an application interface, and call a script.

14. The method of claim 13 comprising:

the transaction is initiated upon activation of a button or an icon,

wherein the button or icon is part of an application onboard the first terminal,

whereby a short wireless communication link is established between the first terminal and the first mobile device,

whereby if the signal of the short wireless communication link drops below a predetermined threshold,

the application performs an action selected from the group consisting of;

lock, cloak, cancel the current transaction, and encrypt data.

15. The method of claim 13 comprising:

upon or after a successful user authentication,

the first terminal transmits user information wirelessly to a remote terminal using an RFID emulator or an RFID simulator.

16. The method of claim 13 whereby:

the first terminal scans devices wirelessly,

the first terminal checks the found devices against a list of authorized devices,

if more than one known devices are found,

the first terminal displays a list of labels corresponding to the found devices,

whereby upon selection of a label, the first terminal requests user authentication corresponding to the selected label.

17. The method of claim 13 comprising:

the first terminal sending an authentication code to the first mobile device,

wherein the authentication code corresponds to an authentication action selected from the group consisting of;

the authentication program verifies a button is activated or a menu is selected or a display is touched or an application is brought to the foreground,

the authentication program authenticates a pass code,

the authentication program authenticates a response to a challenge question using a sample set stored onboard the first mobile device,

the authentication program authenticates biometric information using a sample set stored onboard the first mobile device, and

the authentication program verifies that both the first mobile device and a second mobile device authorized the transaction,

wherein the second mobile device is distinct from the first mobile device.

18. The method of claim 13 wherein:

a user is logged in to an application, wherein

if the current location is within a pre-determined distance from a pre-defined location or if a pre-determined WIFI network is detected,

the application is timed out after a first pre-determined period of inactivity;

if the current location is not within a pre-determined distance from a known location,

the application is timed out after a second pre-determined period of inactivity,

wherein the second pre-determined period of inactivity is different from the first pre-determined period of inactivity.

19. The method of claim 13 comprising:

the first terminal obtaining a digital key from the authentication program,

the first terminal decrypting encrypted user information using the digital key,

the first terminal using the decrypted user information to perform an action selected from the group consisting of;

login to a user account, fill a form, execute a payment transaction, unlock, and decrypt data.