Cryptographic security functions based on anticipated changes in dynamic minutiae

• US 9,294,448 B2
• Filed: 08/12/2014
• Issued: 03/22/2016
• Est. Priority Date: 02/03/2011
• Status: Active Grant

• Current Assignee: mSIGNIA, Inc.
• Original Assignee: mSIGNIA, Inc.
• Inventors: Miller, Paul Timothy, Tuvell, George Allen
• Primary Examiner(s): HO, DAO Q
• Application Number:
  US14/458,123
• Publication Number:
  US 20150033027A1
• Time in Patent Office: 588 Days
• Field of Search: 380/255
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Dynamic key cryptography validates mobile device users to cloud services by uniquely identifying the user'"'"'s electronic device using a very wide range of hardware, firmware, and software minutiae, user secrets, and user biometric values found in or collected by the device. Processes for uniquely identifying and validating the device include: selecting a subset of minutia from a plurality of minutia types; computing a challenge from which the user device can form a response based on the selected combination of minutia; computing a set of pre-processed responses that covers a range of all actual responses possible to be received from the device if the combination of the particular device with the device'"'"'s collected actual values of minutia is valid; receiving an actual response to the challenge from the device; determining whether the actual response matches any of the pre-processed responses; and providing validation, enabling authentication, data protection, and digital signatures.

Claims

1. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a system to perform operations comprising:

selecting a combination of minutia from a plurality of dynamically changing minutia comprising hardware minutia, firmware minutia, software minutia, geo-location data, calling app data, user secrets, or biometric information;

for a particular device, sending a challenge to the particular device, wherein;

the challenge includes information from which the particular device can collect actual values of minutia corresponding to the selected combination of minutia chosen from the plurality of dynamically changing minutia;

user customization of the particular device results in user-specific values for the collected actual values of minutia; and

based on the challenge and the collected actual values, the particular device can compute an actual response to the challenge;

pre-processing a set of responses to the challenge based on anticipating changes to the plurality of dynamically changing minutia from which the selected combination of minutia is chosen, wherein;

the set of pre-processed responses covers a range of all actual responses possible to be received from the particular device, whether or not an anticipated change has occurred to one or more of the collected actual values, when the combination of the particular device with collected actual values of minutia is valid; and

the set of pre-processed responses comprises information from known updates such that a pre-processed response that matches the actual response detects presence or absence of anticipated changes in the collected actual values;

comparing the actual response from the particular device to the set of pre-processed responses;

validating the combination of the particular device with the collected actual values when the actual response is included in the set of pre-processed responses for the particular device; and

differentiating the particular device from other devices based on the actual response due to the actual response depending on the user-specific values.

2. The non-transitory machine-readable medium of claim 1, wherein:

the selecting varies the combination of minutia selected each time the challenge is sent to the particular device.

3. The non-transitory machine-readable medium of claim 1, wherein:

the range of all actual responses possible to be to be received from the particular device is restricted to a range of allowable responses; and

the set of pre-processed responses is restricted to the range of allowable responses.

4. The non-transitory machine-readable medium of claim 1, wherein:

the actual response contains no information as to what are the actual values of the minutiae corresponding to the selected combination of minutia for which the challenge includes information.

5. The non-transitory machine-readable medium of claim 1, wherein:

validating the combination of the particular device with the collected actual values enables one or more of authentication of the device, authentication of the user, validation of the software, data protection for data transmitted to or from the device, or digital signature of a message digest.

6. The non-transitory machine-readable medium of claim 5, wherein:

user customization of the particular device increases uniqueness of the device over time in terms of the number of user-specific values, which can be used to differentiate the particular device from other devices, on the device corresponding to minutia of the plurality of dynamically changing minutia.

7. The non-transitory machine-readable medium of claim 1, wherein:

validating the combination of the particular device with the collected actual values enables using a tracking of all known updates of the plurality of dynamically changing minutia to be used to update a device image for the particular device, without the actual response carrying any information about the current device image.

8. The non-transitory machine-readable medium of claim 1, wherein:

validating the combination of the particular device with the collected actual values enables decrypting the actual response, without the actual response containing information as to what the actual values are.

9. The non-transitory machine-readable medium of claim 1, wherein:

an index of the plurality of dynamically changing minutia that enables the device to collect actual values of minutia corresponding to the selected combination of minutia chosen from the plurality of dynamically changing minutia varies from device to device.

10. The non-transitory machine-readable medium of claim 1, wherein pre-processing the set of responses possible to be received from the particular device further comprises:

applying knowledge from tracking all known updates so that a change in actual values on the device can be detected from the actual response without the actual response carrying any information about the actual values.

11. A method comprising:

selecting a varying combination of minutia from a plurality of dynamically changing minutia reflecting user personalization associated with a device, the dynamically changing minutia comprising hardware minutia, firmware minutia, software minutia, geo-location data, calling app data, user secrets, or biometric information;

for the device, sending a challenge to the device, wherein;

the challenge includes information from which the device can collect actual values of minutia corresponding to the selected combination of minutia chosen from the plurality of dynamically changing minutia, the collected actual values of minutia comprising user-specific values for the collected actual values of minutia due to user customization of the device; and

from which the device can compute an actual response to the challenge based on the challenge and the collected actual values;

pre-processing a set of responses to the challenge based on anticipating changes to the plurality of dynamically changing minutia from which the selected combination of minutia is chosen, wherein;

the set of pre-processed responses covers a range of all actual responses possible to be received from the device when the combination of the device with collected actual values of minutia is valid;

the set of pre-processed responses comprises information from known updates of the plurality of dynamically changing minutia such that a preprocessed response of the set of pre-processed responses that matches the actual response indicates presence or absence of changes in the collected actual values; and

the set of pre-processed responses is used to differentiate the device from other devices based on user customization of the device due to the actual response depending on the user-specific values;

comparing the actual response from the device to the set of pre-processed responses; and

validating the combination of the device with the collected actual values when the actual response is included in the set of pre-processed responses for the device.

12. The method of claim 11, wherein:

the plurality of dynamically changing minutia comprises hardware minutia, firmware minutia, software minutia, geo-location data, calling app data, user secrets, or biometric information.

13. The method of claim 11, wherein:

the plurality of dynamically changing minutia comprises user customizations, including information specific to the user affecting software minutia values, geo-location data, calling app data, user secrets, or biometric information.

14. The method of claim 11, wherein:

the plurality of dynamically changing minutia reflecting user personalization of the device comprises software minutia that changes dynamically via various individual instantiations of the user, including elements requiring predictable, constant change in normal situations, such elements comprising;

frequently called phone numbers, contacts, email, or network connection data stored on the device.

15. The method of claim 11, wherein:

the selecting varies the combination of minutia selected each time the challenge is sent to the device.

16. The method of claim 11, wherein:

the collected actual values on the device are inferred from a pre-processed response that matches the actual response; and

the actual response contains no information encrypting the collected actual values of the minutiae corresponding to the selected combination of minutia for which the challenge includes information.

17. The method of claim 11, wherein:

the user personalization of the device results in user-specific values for the collected actual values of minutia, wherein the actual response is computed based on the challenge and the collected actual values; and

the user personalization of the device is used to differentiate the device from other devices based on the actual response due to the actual response depending on the user-specific values.

18. The method of claim 11, wherein:

the user personalization of the device increases uniqueness of the device over time in terms of the number of user-specific values, which can be used to differentiate the device from other devices, on the device corresponding to minutia of the plurality of dynamically changing minutia.

19. The method of claim 11, further comprising:

anticipating changes to the plurality of dynamically changing minutia by tracking all known updates; and

applying knowledge from the updates for selecting the combination of minutia from the plurality of dynamically changing minutia so that a change to the collected actual values of minutia can be inferred from a preprocessed response that matches the actual response without the actual response carrying any information about the actual values.

20. A system comprising a server configured to communicate with a device, wherein:

the server variably selects a combination of minutia from a plurality of dynamically changing minutia comprising hardware minutia, firmware minutia, software minutia, geo-location data, calling app data, user secrets, or biometric information;

for the device, the server sends a challenge to the device, wherein;

the challenge includes information from which the device can collect actual values of minutia corresponding to the selected combination of minutia chosen from the plurality of dynamically changing minutia;

user customization of the device results in user-specific values for the collected actual values of minutia; and

based on the challenge and the collected actual values, the device computes an actual response to the challenge;

the server pre-processes a set of responses to the challenge based on anticipating changes to the plurality of dynamically changing minutia from which the selected combination of minutia is chosen, wherein;

the set of pre-processed responses covers a range of all actual responses possible to be received from the device when the combination of the device with collected actual values of minutia is valid; and

processing the set of pre-processed responses applies knowledge from tracking known updates so that changes in the collected actual values are detected from the actual response without the actual response carrying any information about the actual values;

the server compares the actual response from the device to the set of pre-processed responses wherein the user customization of the device is used to differentiate the device from other devices based on the actual response due to the actual response depending on the user-specific values; and

the server validates the combination of the device with the collected actual values when the actual response is included in the set of pre-processed responses for the device, wherein the actual response contains no information as to what are the collected actual values.