System and method for identity recognition and affiliation of a user in a service transaction

• US 9,503,452 B1
• Filed: 06/27/2016
• Issued: 11/22/2016
• Est. Priority Date: 04/07/2016
• Status: Active Grant

• Current Assignee: Atul Gupta, Shashank Jaywant Pandhare, Srinivas Kumar
• Original Assignee: Automiti LLC
• Inventors: Gupta, Atul, Pandhare, Shashank Jaywant, Kumar, Srinivas
• Primary Examiner(s): Powers, William
• Application Number:
  US15/193,764
• Time in Patent Office: 148 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/306 User profiles

Abstract

The method integrates the dynamic and authoritative posture of an authenticated user, a registered device, and a registered service provider as a conclusive proof of identity recognition for affiliation of associated contextual attribution and referential integrity. In addition to relieving the user of the burden of remembering multiple passwords for a plurality of services, the method provides a means to facilitate an affiliation oriented architecture for a broad spectrum of web and cloud based services with affiliation aware content streaming, leveraging the affiliation score as a key trust metric. The method provides protection from user-agnostic delegation and impersonation of identity, social engineering, and compromised passwords, which are exploited by numerous strains of landed malware to launch multi-stage coordinated cyber-attacks on consumer accounts and enterprise systems. The method of affiliation based on identity recognition provides authoritative, contextual, and consensual user information, of relevance in a live transaction, to the service provider.

Claims

1. A method of providing authoritative identity recognition of a user at a device to an accessed service for authentication including a client application, a device agent, a service agent, a broker agent, a broker service, a user service authentication code (SAC), a device asset identification number (AIN), an account number, a pre-authentication token, and a one-time user token, the method comprising:

registering, of the user with the broker agent, to create a password and a user identification code (UIC) for the user, linked to the account number associated with a group of users;

registering, by the user at the device with the broker agent, the device to create a device profile comprising of at least the received unique device identifiers required to generate a device watermark and a device pre-shared key, and to create a device AIN for the device;

registering, by the user, a plurality of services with the broker agent using service profiles, wherein a service profile comprises of a service principal name (SPN), a username associated with the SPN, a password, and a device AIN, and further wherein the password is encrypted at the device using the device watermark and the user SAC;

storing, by the broker agent, in a broker repository, the registered user, device, and service profiles;

accessing, by the user at the device, a service, wherein the device agent is executing on the device and the service agent is executing on the accessed service;

clicking, by the user, on a service icon displayed by the client application on the device via the service agent of the accessed service to provide consent for identity recognition;

prompting, by the client application, to receive the user SAC from the user;

generating, by the device agent for the client application, a user token request containing the device AIN, the account number, a timestamp, a digital signature generated using the device watermark and the timestamp, the service principal name, the username associated with the SPN, and optionally a received digitally signed service identifier via the service agent;

sending the generated user token request by the device agent to the broker agent;

processing the received user token request by the broker agent to generate a one-time user token linked to the accessed service, comprising of the encrypted password or a pre-authentication token issued for the user by the accessed service to the broker agent using the username and a secret key;

sending the generated one-time user token by the broker agent to the device agent;

decrypting, by the device agent at the device, the encrypted password in the received one-time user token using the device watermark and the user SAC;

forwarding, by the device agent, the decrypted password or the pre-authentication token with the one-time user token, via the client application, to the service agent of the accessed service;

verifying, by the service agent of the accessed service with the broker agent, the one-time user token received from the client application;

authenticating, by the accessed service, the user based on the received password or pre-authentication token included with the verified one-time user token; and

notifying the user, by the broker agent, of successful and failed authentication attempts to access the service from the device.

2. The method of claim 1, wherein the device watermark is dynamically generated in memory by a hash function using the device pre-shared key, shared by the broker agent with the device agent over a secure channel, and device identifiers associated with the registered device, autonomously at the device by the device agent, and at the broker agent using the device AIN, and further wherein the device watermark is not stored on the user'"'"'s device or on the broker server in memory or on storage media or transmitted on the network.

3. The method of claim 1, wherein the verification includes sending the received one-time user token to the broker agent for validation of the one-time user token and verification of the service based on the server certificate and the service principal name linked to the accessed service.

4. The method of claim 1, wherein the globally unique device profile of the device registered for the account number comprises device non-repudiable volatile and non-volatile software, system, and hardware level attributes that include at least one of:

hardware identification, processor identification, manufacturer identification, integrated resource identification, Bluetooth device identification, hardware configuration, service tags, product registrations, wireless service identifiers, geo-location indicators, and device AIN.

5. The method of claim 1, wherein the notification is sent as an email, text, or voice message and includes at least an episode date, time, geo-location, device identifier, and service principal name.

6. The method of claim 1, wherein a plugin loaded at the device by the client application generates the user token request without requiring the service agent.

7. A method of providing an affiliation score along with component scores and affiliation attributes for a user at a device to an accessed service with or without requiring authentication including a client application, a device agent, a service agent, a broker agent, a broker service, a user personal identification code (PIC), a device asset identification number (AIN), an account number, a pre-authentication token, a one-time user token, and a plurality of data providers, the method comprising:

registering, of the user with the broker agent, to create a password and a user identification code (UIC) for the user, linked to the account number associated with a group of users;

registering, by the user at the device with the broker agent, the device to create a device profile comprising of at least the received unique device identifiers required to generate a device watermark, a device pre-shared key, and to create a device AIN for the device;

registering, by the user, a plurality of services with the broker agent, using service profiles, wherein a service profile comprises of a service principal name (SPN), a username associated with the SPN, a password, and a device AIN, and further wherein the password is encrypted at the device using the device watermark and the user SAC;

storing, by the broker agent, in a broker repository, the registered user, device, and service profiles;

accessing, by the user at the device a service, wherein the device agent is executing on the device and the service agent is executing on the accessed service;

clicking, by the user, on a service icon displayed by the client application on the device via the service agent of the accessed service to provide consent for identity affiliation;

prompting, by the client application, to receive the user SAC or the user'"'"'s UIC from the user;

generating, by the device agent for the client application, a user token request containing at least the device AIN, the account number, a timestamp, a digital signature generated using the device watermark and the timestamp, the service principal name (SPN), the username associated with the SPN where the accessed service requires authentication or the user'"'"'s UIC encrypted using the device pre-shared key where the accessed service requires no authentication, and a received digitally signed service identifier via the service agent;

sending the generated user token request by the device agent to the broker agent;

processing the received user token request by the broker agent to generate a one-time user token linked to the accessed service comprising the affiliation score, component scores, affiliation attributes, and optionally the encrypted password or a pre-authentication token issued for the user by the accessed service to the broker agent using the username and a secret key;

sending the generated one-time user token by the broker agent to the device agent;

decrypting, by the device agent at the device, the encrypted password in the received one-time user token using the device watermark and the user SAC;

forwarding, by the device agent, the decrypted password or the pre-authentication token with the one-time user token, via the client application, to the service agent of the accessed service;

verifying, by the service agent of the accessed service with the broker agent, the one-time user token received from the client application;

authenticating, by the accessed service, the user based on the received password or pre-authentication token included with the verified one-time user token;

notifying the user, by the broker agent, of successful and failed authentication attempts to access the service from the device; and

personalization of content and services, by the accessed service, based on the received affiliation score, component scores, and affiliation attributes included with the verified one-time user token.

8. A method of claim 7, wherein the accessed service requires only the affiliation attributes for personalization, and not the authentication attributes for authentication, in the one-time user token.

9. The method of claim 7, wherein the calculation of the affiliation score for a user comprises:

harvesting, by the broker service, a variety of user attributes from a plurality of authoritative data providers through directed queries for the user, wherein the user attributes include information across personal, social, professional, and enterprise categories;

sending an invite to the user to accept an affiliation request from a registered acquaintance for consent to establish an affiliation;

notifying the registered acquaintance of the initiation of the affiliation request to the user, wherein the notification is sent as an email, text, or phone message to the registered acquaintance;

constructing, by the broker service, a directed graph to represent entities as nodes and relationships as links using the user attributes and affiliations;

traversing, by the broker service, the directed graph to calculate a plurality of component scores for the user based on a static or dynamic score type and a score calculus, wherein the score calculus is a discrete value, a ranking equation, a weighted equation, or a multi attribute function; and

calculating the affiliation score for the user using a weighted equation based on the component scores.

10. A method of claim 9, wherein the harvesting of user attributes from a data provider is performed by issuing directed queries to retrieve a specific set of attributes for a user and/or organization entity.

11. The method of claim 9, wherein the entities include a community of users, organizations, roles, groups, and attribute-based profiles.

12. The method of claim 9, wherein the relationships represent a set of dependent or independent association attributes and profile attributes mapped to a category, component, score type, score calculus, and impact on the component score.