System and method for verifying status of an authentication device through a biometric profile

• US 9,053,310 B2
• Filed: 08/08/2014
• Issued: 06/09/2015
• Est. Priority Date: 08/08/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/455,640
• Publication Number:
  US 20150046990A1
• Time in Patent Office: 305 Days
• Field of Search: 713/186
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A system and method that includes receiving a first biometric profile and associating the first biometric profile with a first application instance that is assigned as an authentication device of a first account; receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account; comparing the second biometric profile to the first biometric profile; and completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile.

Claims

1. A method comprising:

enrolling a first device instance as an authentication device of a first account in a multi-factor authentication factor system, wherein enrolling a first device instance comprises establishing a set of authentication credentials for a set of accounts on the first device instance;

at the first device instance, collecting a reference biometric profile;

transmitting the reference biometric profile to the multi-factor authentication system;

at the multi-factor authentication factor system, associating the reference biometric profile with the first account;

initiating enrollment of a second device instance of the first account;

at the second device instance, collecting a second biometric profile;

transmitting the second biometric profile to the multi-factor authentication system;

comparing the second biometric profile to the reference biometric profile associated with the first account; and

completing the enrollment of the second device instance enrollment according to a result of the comparison of the second biometric profile and the reference biometric profile, wherein completing the enrollment of the second device instance comprises, when the second biometric profile is confirmed to correspond to the reference biometric profile, establishing a second set of authentication credentials for the set of accounts on the second device instance.

2. The method of claim 1, wherein the second set of credentials is a copy of the first set of credentials stored at the multi-factor authentication system.

3. The method of claim 1, further comprising updating the first set of credentials used by the first device instance at least one time after enrollment.

4. The method of claim 1, wherein completing the enrollment of the second device instance comprises invalidating the authentication credentials of the first device.

5. The method of claim 1, wherein completing the enrollment of the second device instance enrollment according to the result of the comparison of the second biometric profile and the reference biometric profile comprises, when the second biometric profile is confirmed to not correspond to the reference biometric profile, rejecting enrollment of the second device instance.

6. The method of claim 1, wherein the first device instance is a different physical device from the second device instance.

7. The method of claim 1, wherein the first device instance is a first application installation instance on a first physical device, and the second device instance is a second application installation instance on the first physical device.

8. The method of claim 7, wherein the first application installation is a different installation of the same application as the second application installation.

9. The method of claim 7, wherein the second device installation instance corresponds to an application instance with at least partially cleared authentication credentials.

10. The method of claim 1, further comprising collecting an updated biometric profile at time after initially collecting the reference biometric profile;

and updating the reference biometric profile associated with the first account.

11. The method of claim 1, wherein a biometric profile additionally embeds knowledge-based factor of authentication information;

and wherein comparing the second biometric profile to the reference biometric profile associated with the first account further comprises comparing the knowledge-based factor of authentication information embedded in the second biometric profile to the reference biometric profile.

12. The method of claim 11, wherein collecting the reference biometric profile and the second biometric profile is a collected audio recording of a spoken pass phrase.

13. The method of claim 1, wherein the reference and second biometric profiles are audio biometric profiles.

14. The method of claim 1, wherein the reference and second biometric profiles are image-based biometric profiles.

15. The method of claim 1, wherein the reference and second biometric profiles are fingerprint biometric profiles.

16. The method of claim 1, wherein the reference and second biometric profiles is a combination of at least heart rate, blood pressure, and body temperature.

17. A method comprising:

receiving a first biometric profile and associating the first biometric profile with a first application instance that is assigned as an authentication device of a first account;

establishing a first set of authentication credentials for a set of accounts on the first application instance;

receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account to enroll the second application instance as an authentication application of the first account;

comparing the second biometric profile to the first biometric profile; and

completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile, wherein completing the request of the second application instance comprises, if the second biometric profile satisfies a condition of matching the first biometric profile when compared, establishing a second set of authentication credentials for the set of accounts on the second application instance.

18. The method of claim 17, wherein the first application instance is on a different physical device from the second application instance.

19. The method of claim 17, wherein the first and second biometric profiles are audio biometric profiles.

20. The method of claim 19, wherein an audio biometric profile additionally embeds knowledge-based pass phrase information;

and wherein comparing the second biometric profile to the first biometric profile associated with the first account further comprises comparing an embedded pass phrase of the second biometric to an embedded pass phrase of the first biometric profile.

21. The method of claim 17, wherein the first and second biometric profiles are image-based biometric profiles.

22. The method of claim 17, wherein the first and second biometric profiles are fingerprint biometric profiles.

23. A method comprising:

receiving a first biometric profile and associating the first biometric profile with a first a first application instance that is assigned as an authentication device of a first account;

receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account to verify multi-factor authentication of the first account;

comparing the second biometric profile to the first biometric profile; and

completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile, wherein completing the request of the second application instance comprises, if the second biometric profile satisfies a condition of matching the first biometric profile when compared, verifying multi-factor authentication of the user.

24. The method of claim 23, wherein the first application instance is the same application instance as the second application instance.

25. A method comprising:

enrolling a first device instance as an authentication device of a first account in a multi-factor authentication factor system;

at the first device instance, collecting a reference biometric profile, wherein a biometric profile is an audio recording of a spoken pass phrase, wherein the pass phrase is embedded knowledge-based factor of authentication information;

transmitting the reference biometric profile to the multi-factor authentication system;

at the multi-factor authentication factor system, associating the reference biometric profile with the first account;

initiating enrollment of a second device instance of the first account;

at the second device instance, collecting a second biometric profile;

transmitting the second biometric profile to the multi-factor authentication system;

comparing the second biometric profile to the reference biometric profile associated with the first account, which comprises comparing knowledge-based factor of authentication information embedded in the second biometric profile to knowledge-based factor of authentication information embedded in the reference biometric profile; and

completing the enrollment of the second device instance enrollment according to a result of the comparison of the second biometric profile and the reference biometric profile.

26. A method comprising:

receiving a first biometric profile and associating the first biometric profile with a first application instance that is assigned as an authentication device of a first account;

receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account, wherein the first and second biometric profiles are audio biometric profiles that embed knowledge-based pass phrase information;

comparing the second biometric profile to the first biometric profile, which comprises comparing an embedded pass phrase of the second biometric to an embedded pass phrase of the first biometric profile; and

completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile.