System and method for verifying status of an authentication device through a biometric profile

• US 9,454,656 B2
• Filed: 05/04/2015
• Issued: 09/27/2016
• Est. Priority Date: 08/08/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/703,786
• Publication Number:
  US 20150235017A1
• Time in Patent Office: 512 Days
• Field of Search: 726/6
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A system and method that includes receiving a first biometric profile and associating the first biometric profile with a first application instance that is assigned as an authentication device of a first account; receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account; comparing the second biometric profile to the first biometric profile; and completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile.

Claims

1. A method comprising:

receiving a first biometric profile and associating the first biometric profile with a first account, wherein the first account is associated with a first application instance;

establishing a first set of authentication credentials for a set of accounts on the first application instance;

receiving a second biometric profile for a second application instance, wherein the second application instance is making a request on behalf of the first account;

comparing the second biometric profile to the first biometric profile; and

completing the request of the second application instance according to results of comparing the second biometric profile to the first biometric profile.

2. The method of claim 1, further comprising prompting a user of the first account to provide the second biometric profile in response to heightened permissions requirements.

3. The method of claim 2, wherein prompting a user of the first account to provide the second biometric profile in response to heightened permissions requirements comprises prompting the user to provide a non-zero number of distinct biometric signals;

wherein the number of distinct biometric signals is set according to the heightened permissions requirements.

4. The method of claim 1, further comprising prompting a user of the first account to provide the second biometric profile in response to a security flag raised after several consecutive failed login attempts.

5. The method of claim 1, wherein receiving the first biometric profile comprises receiving at least two distinct biometric signals;

wherein comparing the second biometric profile to the first biometric profile comprises comparing a biometric signal of the second biometric profile to only one biometric signal of the first biometric profile.

6. The method of claim 1, wherein receiving the first biometric profile comprises receiving at least two distinct biometric signals;

wherein receiving the second biometric profile comprises receiving at least two distinct biometric signals;

wherein comparing the second biometric profile to the first biometric profile comprises comparing biometric signals of the second biometric profile to at least two biometric signals of the first biometric profile.

7. A method comprising:

receiving a first biometric profile and associating the first biometric profile with a first account, wherein the first account is associated with a first application instance;

establishing a first set of authentication credentials for a set of accounts on the first application instance;

initiating enrollment of a second device instance of the first account;

receiving a second biometric profile at the second device instance;

transmitting the second biometric profile to the multi-factor authentication system;

comparing the second biometric profile to the first biometric profile; and

completing the enrollment of the second device instance according to results of comparing the second biometric profile to the first biometric profile.

8. The method of claim 7, wherein completing the enrollment of the second device instance comprises, when the second biometric profile is confirmed to correspond to the first biometric profile, establishing a second set of authentication credentials for the set of accounts on the second device instance.

9. The method of claim 8, wherein the second set of credentials is a copy of the first set of credentials stored at the multi-factor authentication system.

10. The method of claim 8, further comprising updating the first set of credentials used by the first device instance at least one time after enrollment.

11. The method of claim 8, wherein completing the enrollment of the second device instance comprises invalidating the authentication credentials of the first device.

12. The method of claim 8, wherein completing the enrollment of the second device instance enrollment according to the result of the comparison of the second biometric profile and the reference biometric profile comprises, when the second biometric profile is confirmed to not correspond to the reference biometric profile, rejecting enrollment of the second device instance.

13. The method of claim 8, wherein the first device instance is a different physical device from the second device instance.

14. The method of claim 8, wherein the first device instance is a first application installation instance on a first physical device, and the second device instance is a second application installation instance on the first physical device.

15. The method of claim 7, wherein receiving the first biometric profile comprises receiving at least two distinct biometric signals;

wherein comparing the second biometric profile to the first biometric profile comprises comparing a biometric signal of the second biometric profile to only one biometric signal of the first biometric profile.

16. The method of claim 7, wherein receiving the first biometric profile comprises receiving at least two distinct biometric signals;

wherein receiving the second biometric profile comprises receiving at least two distinct biometric signals;

wherein comparing the second biometric profile to the first biometric profile comprises comparing biometric signals of the second biometric profile to at least two biometric signals of the first biometric profile.

17. The method of claim 7, wherein receiving the first biometric profile comprises receiving at least two distinct biometric signals;

further comprising prompting a user of the first account to provide a non-zero number of distinct biometric signals in the second biometric profile;

wherein the number of distinct biometric signals is set according to permissions requirements.