Multi-device behavioral fingerprinting

• US 9,083,687 B2
• Filed: 07/31/2012
• Issued: 07/14/2015
• Est. Priority Date: 09/24/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Hyde, Roderick A., Levien, Royce A., Huang, Xuedong, Gerrity, Daniel A., Dyor, Matthew G., Tegreene, Clarence T., Davis, Marc E., Myhrvold, Nathan P., Malamud, Mark A., Lord, Robert W., Lord, Richard T.
• Primary Examiner(s): Gelagay, Shewaye
• Assistant Examiner(s): DOLLY, KENDALL LYNN
• Application Number:
  US13/563,599
• Publication Number:
  US 20140040989A1
• Time in Patent Office: 1,078 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Disclosed herein are example embodiments for multi-device behavioral fingerprinting by a user device or a server device. For certain example embodiments, at least one device may obtain at least one behavioral fingerprint that is associated with at least one authorized user, with the at least one behavioral fingerprint including one or more indicators of utilization of two or more user devices by the at least one authorized user. The at least one device may perform at least one authentication-related operation based at least partially on the at least one behavioral fingerprint.

Claims

1. A method, comprising:

obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user;

obtaining one or more indicators of one or more predicted acts of the at least one authorized user with regard to at least one of the two or more user devices, the one or more indicators of one or more predicted acts derived at least partly from at least one statistical analysis of one or more observed acts associated with the at least one authorized user; and

performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts,

wherein at least one of the obtaining at least one behavioral fingerprint or the performing at least one authentication-related operation is at least partially implemented using one or more processing devices.

2. A machine, comprising:

circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user;

circuitry for obtaining one or more indicators of one or more predicted acts of the at least one authorized user with regard to at least one of the two or more user devices, the one or more indicators of one or more predicted acts derived at least partly from at least one statistical analysis of one or more observed acts associated with the at least one authorized user; and

circuitry for performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts.

3. The machine of claim 2, wherein circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user comprises:

circuitry for incorporating one or more indicators of utilization of a first user device of the two or more user devices by the at least one authorized user and one or more indicators of utilization of a second user device of the two or more user devices by the at least one authorized user into the at least one behavioral fingerprint.

4. The machine of claim 2, wherein circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user comprises:

circuitry for receiving one or more updated indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user; and

circuitry for receiving one or more updated indicators of observed utilization of a second user device of the two or more user devices by the at least one authorized user.

5. The method machine of claim 4, wherein:

circuitry for receiving one or more updated indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user includes at least receiving, by at least one server device, from the first user device the one or more updated indicators of observed utilization of the first user device of the two or more user devices by the at least one authorized user; and

circuitry for receiving one or more updated indicators of observed utilization of a second user device of the two or more user devices by the at least one authorized user includes at least receiving, by the at least one server device, from the second user device the one or more updated indicators of observed utilization of the second user device of the two or more user devices by the at least one authorized user.

6. The machine of claim 5, wherein circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user comprises:

circuitry for incorporating the one or more updated indicators of observed utilization of the first user device and the one or more updated indicators of observed utilization of the second user device into the at least one behavioral fingerprint to produce at least one updated behavioral fingerprint.

7. The machine of claim 6, wherein circuitry for performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts comprises:

circuitry for performing at least one other authentication-related operation based at least partially on the at least one updated behavioral fingerprint and the one or more indications of one or more predicted acts.

8. The machine of claim 7, further comprising:

circuitry for transmitting at least one result of the at least one other authentication-related operation that is based at least partially on the at least one updated behavioral fingerprint and the one or more indications of one or more predicted acts to at least one of (i) the first device of the two or more user devices or (ii) a third device.

9. The machine of claim 2, wherein circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user, comprises:

circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices.

10. The machine of claim 9, wherein circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices comprises:

circuitry for converting the one or more first indicators to the one or more second indicators to at least partly compensate for the first user device corresponding to a first user device type and the second user device corresponding to a second user device type, the first user device type different from the second user device type.

11. The machine of claim 9, wherein circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices comprises:

circuitry for converting the one or more first indicators that correspond to a first communication mode to the one or more second indicators that correspond to a second communication mode, the first communication mode different from the second communication mode.

12. The machine of claim 11, wherein circuitry for converting the one or more first indicators that correspond to a first communication mode to the one or more second indicators that correspond to a second communication mode, the first communication mode different from the second communication mode comprises:

circuitry for converting the one or more first indicators that correspond to an email communication mode to the one or more second indicators that correspond to a texting communication mode.

13. The machine of claim 11, wherein circuitry for converting the one or more first indicators that correspond to a first communication mode to the one or more second indicators that correspond to a second communication mode, the first communication mode different from the second communication mode comprises:

circuitry for converting the one or more first indicators that correspond to a voice communication mode to the one or more second indicators that correspond to an instant message communication mode.

14. The machine of claim 11, wherein circuitry for converting the one or more first indicators that correspond to a first communication mode to the one or more second indicators that correspond to a second communication mode, the first communication mode different from the second communication mode comprises:

circuitry for converting the one or more first indicators that correspond to a social-network-based communication mode to the one or more second indicators that correspond to a non-social-network-based communication mode.

15. The machine of claim 9, wherein circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices comprises:

circuitry for converting the one or more first indicators that correspond to a first form of interaction with a service to the one or more second indicators that correspond to a second form of interaction with the service, the first form of interaction different from the second form of interaction.

16. The machine of claim 15, wherein circuitry for converting the one or more first indicators that correspond to a first form of interaction with a service to the one or more second indicators that correspond to a second form of interaction with the service, the first form of interaction different from the second form of interaction comprises:

circuitry for converting the one or more first indicators that correspond to a browser form of interaction with the service to the one or more second indicators that correspond to a service-specific app form of interaction with the service.

17. The machine of claim 9, wherein circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices comprises:

circuitry for converting the one or more first indicators that correspond to a first payment type via the first user device to the one or more second indicators that correspond to a second payment type via the second user device, the first payment type different from the second payment type.

18. The machine of claim 17, wherein circuitry for converting the one or more first indicators that correspond to a first payment type via the first user device to the one or more second indicators that correspond to a second payment type via the second user device, the first payment type different from the second payment type comprises:

circuitry for converting the one or more first indicators that correspond to a near field communication (NFC) payment type via the first user device to the one or more second indicators that correspond to a displayed visual code payment type via the second user device.

19. The machine of claim 9, wherein circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices comprises:

circuitry for converting the one or more first indicators that correspond to a first level of geographical positioning precision with respect to the first user device to the one or more second indicators that correspond to a second level of geographical positioning precision with respect to the second user device, the first level different from the second level.

20. The machine of claim 9, wherein circuitry for converting one or more first indicators of observed utilization of a first user device of the two or more user devices by the at least one authorized user to one or more second indicators of utilization for a second user device of the two or more user devices comprises:

circuitry for converting the one or more first indicators that correspond to a first user interaction with regard to the first user device to the one or more second indicators that correspond to a second user interaction with regard to the second user device, the first user interaction different from the second user interaction.

21. The machine of claim 20, wherein circuitry for converting the one or more first indicators that correspond to a first user interaction with regard to the first user device to the one or more second indicators that correspond to a second user interaction with regard to the second user device, the first user interaction different from the second user interaction comprises:

circuitry for converting the one or more first indicators that correspond to speech interaction with regard to the first user device to the one or more second indicators that correspond to textual interaction with regard to the second user device.

22. The machine of claim 20, wherein circuitry for converting the one or more first indicators that correspond to a first user interaction with regard to the first user device to the one or more second indicators that correspond to a second user interaction with regard to the second user device, the first user interaction different from the second user interaction comprises:

circuitry for converting the one or more first indicators that correspond to touch-screen interaction with a first screen having a first size with regard to the first user device to the one or more second indicators that correspond to touch-screen interaction with a second screen having a second size with regard to the second user device, the first size different from the second size.

23. The machine of claim 22, wherein circuitry for converting the one or more first indicators that correspond to touch-screen interaction with a first screen having a first size with regard to the first user device to the one or more second indicators that correspond to touch-screen interaction with a second screen having a second size with regard to the second user device, the first size different from the second size comprises:

circuitry for scaling the one or more first indicators that correspond to one or more touch inputs for the first screen to the one or more second indicators that correspond to one or more touch inputs for the second screen responsive to at least one dimensional measurement that is different between the first size of the first screen and the second size of the second screen.

24. The machine of claim 22, wherein circuitry for converting the one or more first indicators that correspond to touch-screen interaction with a first screen having a first size with regard to the first user device to the one or more second indicators that correspond to touch-screen interaction with a second screen having a second size with regard to the second user device, the first size different from the second size comprises:

circuitry for adjusting the one or more first indicators that correspond to one or more touch inputs for the first screen to the one or more second indicators that correspond to one or more touch inputs for the second screen responsive to at least one pixel count difference between the first screen and the second screen.

25. The machine of claim 20, wherein circuitry for converting the one or more first indicators that correspond to a first user interaction with regard to the first user device to the one or more second indicators that correspond to a second user interaction with regard to the second user device, the first user interaction different from the second user interaction comprises:

circuitry for converting the one or more first indicators that correspond to social-network-based interaction with regard to the first user device to the one or more second indicators that correspond to non-social-network-based interaction with regard to the second user device.

26. The machine of claim 2, wherein circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user comprises:

circuitry for obtaining one or more indicators representing one or more observed habits of the at least one authorized user with respect to at least one of the two or more user devices;

circuitry for obtaining one or more indicators representing observed usage of at least one of the two or more user devices by the at least one authorized user; and

circuitry for obtaining one or more indicators representing one or more observed actions of the at least one authorized user with respect to at least one of the two or more user devices.

27. The machine of claim 2, wherein circuitry for performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts comprises:

circuitry for identifying a user of at least one of the two or more user devices (i) as including at least the at least one authorized user, (ii) as including at least another authorized user, or (iii) as not including at least a known authorized user based at least partially on the at least one behavioral fingerprint, the one or more indications of one or more predicted acts, and one or more detected acts of the user.

28. The machine of claim 2, wherein circuitry for performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts comprises:

circuitry for approving at least one transaction to be conducted via at least one of the two or more user devices based at least partially on the at least one behavioral fingerprint, the one or more indications of one or more predicted acts, and one or more detected acts of a user of the at least one of the two or more user devices, the at least one transaction including at least one of releasing funds for the transaction, providing bank card authorization for the transaction, or providing credit card authorization for the transaction.

29. The machine of claim 2, wherein circuitry for performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts comprises:

circuitry for permitting access to at least one feature of at least one of the two or more user devices based at least partially on the at least one behavioral fingerprint, the one or more indications of one or more predicted acts, and one or more detected acts of a user of the at least one of the two or more user devices.

30. The machine of claim 2, wherein circuitry for obtaining one or more indicators of one or more predicted acts of the at least one authorized user with regard to at least one of the two or more user devices, the one or more indicators of one or more predicted acts derived at least partly from at least one statistical analysis of one or more observed acts associated with the at least one authorized user comprises:

circuitry for obtaining one or more indicators of one or more predicted acts of the at least one authorized user with regard to at least one of the two or more user devices, the one or more indicators of one or more predicted acts derived at least partly from at least one statistical analysis of one or more monitored acts of at least one user known to be at least one authorized user of the at least one of the two or more user devices.

31. The machine of claim 2, wherein circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user comprises:

circuitry for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user, including at least converting (i) one or more first indicators of observed utilization that correspond to at least one feature of a first user device of the two or more devices to (ii) one or more second indicators of observed utilization that correspond to at least one feature of a second user device of the two or more user devices, wherein the one or more first indicators of observed utilization and the one or more second indicators of observed utilization correspond to different features of the first user device and second user device.

32. A machine, comprising:

means for obtaining at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user;

means for obtaining one or more indicators of one or more predicted acts of the at least one authorized user with regard to at least one of the two or more user devices, the one or more indicators of one or more predicted acts derived at least partly from at least one statistical analysis of one or more observed acts associated with the at least one authorized user; and

means for performing at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts,

wherein at least one of the means for obtaining at least one behavioral fingerprint or the means for performing at least one authentication-related operation is at least partially implemented using one or more processing devices.

33. A system, comprising:

a computing device; and

at least some instructions which, when executed on the computing device, cause the computing device to at least;

obtain at least one behavioral fingerprint that is associated with at least one authorized user, the at least one behavioral fingerprint including at least one or more indicators of utilization of two or more user devices by the at least one authorized user;

obtain one or more indicators of one or more predicted acts of the at least one authorized user with regard to at least one of the two or more user devices, the one or more indicators of one or more predicted acts derived at least partly from at least one statistical analysis of one or more observed acts associated with the at least one authorized user; and

perform at least one authentication-related operation based at least partially on the at least one behavioral fingerprint and the one or more indications of one or more predicted acts.