Method for peer to peer mobile context authentication

• US 9,754,097 B2
• Filed: 02/02/2015
• Issued: 09/05/2017
• Est. Priority Date: 02/21/2014
• Status: Active Grant

• Current Assignee: LiveEnsure, Inc.
• Original Assignee: LiveEnsure, Inc.
• Inventors: Hessler, Christian J
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/611,486
• Publication Number:
  US 20150244699A1
• Time in Patent Office: 946 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The invention is a system and a method for achieving private, personalized, real-time authentication of one or more networked peer users and their mobile or wearable electronic computing devices through holistic contextual verification of the device, location, proximity, knowledge and behavioral attributes for a defined session, event, object or resource access or mutual user and device identity context verification.

Claims

1. A computer-based method of authenticating a first user on a primary electronic data processing unit to a second user on a secondary electronic data processing unit, the steps comprising:

providing a server, said server comprises a memory;

providing the primary electronic data processing unit, the primary electronic data processing unit comprising a first application;

providing the secondary electronic data processing unit, the secondary electronic data processing unit comprising a second application;

providing an intermediate host, said intermediate host comprising a presentation, said intermediate host is networked with said primary electronic data processing unit and said second electronic data processing unit;

initiating a direct connection between said primary electronic data processing unit and said secondary electronic data processing unit;

creating, by said first application, one or more tagged resources associated with an authentication request object;

sending, by said server, to said secondary electronic data processing unit the one or more tagged resources;

presenting said one or more tagged resources to said secondary electronic data processing unit application;

creating by said server, a first template and a second template in said memory;

processing, by said server, said first template;

processing, by said secondary electronic data processing unit, said second template;

presenting, by said intermediate host via a second channel, said one or more tagged resources to said secondary electronic data processing unit;

retrieving, by said secondary electronic data processing unit, said second template by following said one or more tagged resources, utilizing said secondary electronic data processing unit application to retrieve said second template independently of said server via a third channel, said third channel separate from said second channel;

interrogating, by said server, a plurality of first contextual factors;

populating, by said server, said first template based on said plurality of first contextual factors;

constructing a one-time contextual server signature by said server based on said first template;

interrogating, by said secondary electronic data processing unit application, a plurality of second contextual factors from a perspective of said secondary electronic data processing unit;

populating, by said secondary electronic data processing unit application, said second template based on said plurality of second contextual factors;

constructing, by said secondary electronic data processing unit application, a one-time contextual application signature based on said second template; and

responsive to determining, by said server, said one-time contextual application signature matching said one-time contextual server signature;

authenticating and granting access to the first user, and responsive to determining, by said server, said one-time contextual application signature failing to match said one-time contextual server signature;

denying access to the first user.

2. The method of claim 1, the method further comprising initiating a direct connection between said primary electronic data processing unit and said secondary electronic data processing unit to trigger a request to authenticate via a synchronous network session between said primary and secondary electronic data processing units without involving said intermediate host.

3. The method of claim 2, wherein said step of receiving by said secondary electronic data processing unit further comprising enabling said secondary electronic data processing unit'"'"'s ability to connect directly with said server via said third channel, engage said synchronous network session, consume and process a required authentication service object without scan, sense, enter, input or response to said one or more tagged resources on said intermediate host.

4. The method of claim 2, further comprising said plurality of first contextual factors and said plurality of second contextual factors each selected from the group of contextual factors consisting of:

the server, another server, the first user, the second user, another user, another device, a wearable, a biometric, a location, a proximity, and a supplied credential.

5. The method of claim 2, further comprising requiring an individual and discrete authentication between said secondary electronic data processing unit and both said primary electronic data processing unit and said intermediate host before granting or denying access to the first user.

6. The method of claim 1, wherein said step of retrieving by said secondary electronic data processing unit further comprises enabling said secondary electronic data processing unit'"'"'s ability to scan, sense, enter, input, consume or respond to said one or more tagged resources on said secondary electronic data processing unit directly from said server without involving said intermediary host.

7. The method of claim 1, wherein said step of retrieving by said secondary electronic data processing unit further comprises enabling via said secondary electronic data processing unit'"'"'s ability to scan, sense, enter, input, consume or respond to said one or more tagged resources on said intermediate host.

8. The method of claim 1, wherein said step of receiving by said secondary electronic data processing unit further comprises enabling via said secondary electronic data processing unit'"'"'s ability to connect directly with said server via said third channel, engage an active session, consume and process a required authentication service object without scanning, sensing, entering, inputting or responding to said one or more tagged resources on said intermediate host.

9. The method of claim 1, further comprising said plurality of first contextual factors and said plurality of second contextual factors are each selected from the group of contextual factors consisting of:

the server, another server, the first user, the second user, another user, another device, a wearable, a biometric, a location, a proximity, and a supplied credential.

10. The method of claim 1, further comprising requiring an individual and discrete authentication between said secondary electronic data processing unit and both said primary electronic data processing unit and said intermediate host before granting or denying access to the first user.