Device fingerprint updating for single sign on authentication

• US 9,781,097 B2
• Filed: 02/13/2015
• Issued: 10/03/2017
• Est. Priority Date: 02/18/2014
• Status: Active Grant

• Current Assignee: SecureAuth Incorporated
• Original Assignee: SecureAuth Incorporated
• Inventors: Grajek, Garret Florian, Liu, Chihwei, Quach, Allen Yu, Lo, Jeffrey Chiwai
• Primary Examiner(s): Poltorak, Peter
• Application Number:
  US14/621,826
• Publication Number:
  US 20150237049A1
• Time in Patent Office: 963 Days
• Field of Search: None
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A device fingerprinting system provides an additional factor of authentication. A user device may be redirected, along with user ID parameters, to authentication system. The user device may be sent instructions to execute that collect and send back device characteristic information to the authentication system. The authentication can create a unique fingerprint of the device, and determine if the fingerprint has been seen before. If seen before, the authentication system may send back an authentication token indicating the additional factor of authentication was a success. If the fingerprint has not been seen previously, the authentication system may conduct a one-time password authentication as the additional factor. If successful, the fingerprint may be stored in association with the user device for future authentication as an additional factor.

Claims

1. A computerized fingerprint-based authentication system comprising:

one or more hardware processors configured to cause the fingerprint-based authentication system to;

receive, over a network, a request for authentication of a user computing device associated with a user, the request resulting from a redirection operation sent to the user computing device from a network service requiring additional authentication in addition to a password;

send, over the network, to the user computing device, capture instructions, the capture instructions configured to cause the user computing device to collect a first plurality of characteristic values of the user computing device, the first plurality of the characteristic values representing at least two attributes of the user computing device;

receive, over the network, the first plurality of characteristic values of the user computing device;

compare the first plurality of characteristic values of the user computing device to a second plurality of characteristic values, the second plurality of characteristic values previously stored by the computerized fingerprint-based authentication system;

determine a device certainty score based on a comparison of the first plurality of characteristic values of the user computing device to the second plurality of characteristic values; and

when a determination is made that the device certainty score is above a threshold update score;

update the second plurality of characteristic values in data storage to include the first plurality of characteristic values, and

transmit an authentication token to the user computing device, the authentication token indicating that the user computing device was authenticated by a fingerprinting mechanism.

2. The computerized multi-factor authentication device of claim 1, wherein the at least two attributes of the user computing device comprise one or more of:

a browser type value,

a plurality of browser plugin values,

a plurality of browser flash fonts,

at least one display resolution size value,

at least one value associated with HTML5 local storage,

at least one HTTP header value,

at least one networking address value,

a time zone value,

a language value,

a plurality of browser-accepted language values,

a plurality of browser encoding values,

an IP address value, and

at least one value associated with browser cookie data.

3. The computerized multi-factor authentication device of claim 1, wherein the fingerprint-based authentication system is configured to, when a determination is made that the device certainty score is below the threshold update score:

communicate a one-time password to the user;

receive, over the network, the one-time password from the user computing device;

generate a device fingerprint value associated with the user computing device based on the first plurality of characteristic values;

store the device fingerprint value and the first plurality of characteristic values in data storage; and

transmit the authentication token to the user computing device, the authentication token indicating that the user computing device was authenticated by a fingerprinting mechanism.

4. The computerized multi-factor authentication device of claim 3, wherein the one-time password is communicated by at least one of:

SMS, telephony, push notification, or email.

5. The computerized multi-factor authentication device of claim 1, wherein the fingerprint-based authentication system is configured to store the device fingerprint value in an active directory.

6. The computerized fingerprint-based authentication system of claim 1, wherein the fingerprint-based authentication system is configured to store the device fingerprint value over the network in remote data storage.

7. The computerized fingerprint-based authentication system of claim 1, wherein the fingerprint-based authentication system is configured to store the device fingerprint value in local data storage.

8. The computerized fingerprint-based authentication system of claim 1, wherein the authentication token is configured to allow a plurality of distinct network services to accept the authentication token in lieu of authenticating an additional factor with the fingerprint-based authentication system.

9. The computerized fingerprint-based authentication system of claim 1, wherein the request for authentication comprises profile information, the profile information comprising a user identifier value, and at least one of:

a user email address value, a telephone number value, or an SMS number value.

10. The computerized fingerprint-based authentication system of claim 1, wherein the request for authentication indicates an additional certificate based factor of authentication is required by the network service to authenticate the user.

11. A computerized method for updating a device fingerprint for a user computing device, the method comprising:

by one or more hardware computer processors;

receiving, over a network, a request for authentication of a user computing device associated with a user, the request resulting from a redirection operation sent to the user computing device from a network service requiring additional authentication of the user in addition to a password;

sending, over the network, to the user computing device capture instructions, the capture instructions configured to cause the user computing device to collect a plurality of characteristic values of the user computing device, the first plurality of the characteristic values representing at least two attributes of the user computing device;

receiving, over the network, the first plurality of characteristic values of the user computing device;

comparing the first plurality of characteristic values of the user computing device to a second plurality of characteristic values, the second plurality of characteristic values previously stored by a computerized fingerprint-based authentication system;

determining a device certainty score based on a comparison of the first plurality of characteristic values of the user computing device to the second plurality of characteristic values; and

when a determination is made that the device certainty score is above a threshold update score;

updating the second plurality of characteristic values in data storage to include the first plurality of characteristic values, and

transmitting an authentication token to the user computing device, the authentication token indicating that the user computing device was authenticated by a fingerprinting mechanism.

12. The computerized method of claim 11, wherein the at least two attributes of the user computing device comprise one or more of:

a browser type value,

a plurality of browser plugin values,

a plurality of browser flash fonts,

at least one display resolution size value,

at least one value associated with HTML5 local storage,

at least one HTTP header value,

at least one networking address value,

a time zone value,

a language value,

a plurality of browser-accepted language values,

a plurality of browser encoding values,

an IP address value, and

at least one value associated with browser cookie data.

13. The computerized method of claim 11, further comprising:

when a determination is made that the device certainty score is below the threshold update score;

communicating a one-time password to the user;

receiving, over the network, the one-time password from the user computing device;

generating a device fingerprint value associated with the user computing device based on the first plurality of characteristic values;

storing the device fingerprint value and the first plurality of characteristic values in data storage; and

transmitting the authentication token to the user computing device, the authentication token indicating that the user computing device was authenticated by a fingerprinting mechanism.

14. The computerized method of claim 13, wherein the one-time password is communicated by at least one of:

SMS, telephony, push notification, or email.

15. The computerized method of claim 11, further comprising storing the device fingerprint value in an active directory.

16. The computerized method of claim 11, further comprising storing the device fingerprint value over the network in remote data storage.

17. The computerized method of claim 11, wherein the request for authentication comprises profile information, the profile information comprising a user identifier value, and at least one of:

a user email address value, a telephone number value, or an SMS number value.

18. The computerized method of claim 11, wherein the request for authentication indicates an additional certificate based factor of authentication is required by the network service to authenticate the user.

19. A non-transitory computer storage medium which stores a program comprising executable code that directs a computing device to perform a process that updates a device fingerprint associated with a user computing device, comprising:

receiving, over a network, a request for authentication of a user computing device associated with a user, the request resulting from a redirection operation sent to the user computing device from a network service requiring additional authentication of the user in addition to a password;

sending, over the network, to the user computing device capture instructions, the capture instructions configured to cause the user computing device to collect a plurality of characteristic values of the user computing device, the first plurality of the characteristic values representing at least two attributes of the user computing device;

receiving, over the network, the first plurality of characteristic values of the user computing device;

comparing the first plurality of characteristic values of the user computing device to a second plurality of characteristic values, the second plurality of characteristic values previously stored by a computerized fingerprint-based authentication system;

determining a device certainty score based on a comparison of the first plurality of characteristic values of the user computing device to the second plurality of characteristic values; and

when a determination is made that the device certainty score is above a threshold update score;

updating the second plurality of characteristic values in data storage to include the first plurality of characteristic values, and

transmitting an authentication token to the user computing device, the authentication token indicating that the user computing device was authenticated by a fingerprinting mechanism.

20. The non-transitory computer storage medium of claim 19, wherein the at least two attributes of the user computing device comprise one or more of:

a browser type value,

a plurality of browser plugin values,

a plurality of browser flash fonts,

at least one display resolution size value,

at least one value associated with HTML5 local storage,

at least one HTTP header value,

at least one networking address value,

a time zone value,

a language value,

a plurality of browser-accepted language values,

a plurality of browser encoding values,

an IP address value, and

at least one value associated with browser cookie data.

21. The non-transitory computer storage medium of claim 19, wherein the device fingerprint value and the first plurality of characteristic values are stored over the network in remote data storage.

22. The non-transitory computer storage medium of claim 19, wherein the device fingerprint value and the first plurality of characteristic values are stored in local data storage.

23. The non-transitory computer storage medium of claim 19, further comprising allowing a plurality of distinct network services to accept the authentication token in lieu of authenticating an additional factor.

24. The non-transitory computer storage medium of claim 19, wherein the request for authentication comprises profile information, the profile information comprising a user identifier value, and at least one of:

a user email address value, a telephone number value, or an SMS number value.