System and method for applying digital fingerprints in multi-factor authentication

• US 10,440,016 B2
• Filed: 12/01/2015
• Issued: 10/08/2019
• Est. Priority Date: 12/09/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Farooqui, Quazi
• Application Number:
  US14/955,377
• Publication Number:
  US 20160164866A1
• Time in Patent Office: 1,407 Days
• Field of Search: 726 1- 33
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for multi-factor authentication with a first client includes receiving a request associated with the first client, initiating an authentication transaction, generating a digital fingerprint based on a set of client properties collected in association with the first client, identifying a second client from data associated with the authentication transaction, analyzing a digital fingerprint based on a set of stored digital fingerprints; generating a concern metric based on the analysis; and notifying an entity that the login request may have originated from an unauthorized source.

Claims

1. A method for multi-factor authentication with a first client operating on a first client device, comprising:

receiving a login request, the login request associated with a first user account, from the first client;

in response to receiving the login request, initiating an authentication transaction;

generating a first client digital fingerprint from a set of first client properties collected from the first client;

identifying a second client, the second client operating on a second client device, from data associated with the first user account;

analyzing the first client digital fingerprint based on a first set of stored digital fingerprints, wherein analyzing the first client digital fingerprint comprises;

generating a machine learning model trained using at least the first set of stored digital fingerprints as a training set, and

evaluating the first client digital fingerprint using the machine learning model;

generating a concern metric based on the analyzing of the first client digital fingerprint;

in response to the concern metric exceeding a threshold concern metric, providing to the second client an authentication request notifying a user that the login request from the first client may have originated from an unauthorized source, wherein the authentication request to the second client comprises

     1) the concern metric comprising a probability value that the login request by the first client is unauthorized, and

     2) one or more suggested authorization options, wherein content of the suggested authorization options is determined based on degree of the concern metric;

receiving a user response to the authentication request, wherein the user response comprises one of an authorization or denial of the login request;

updating the training set to include the generated first client digital fingerprint and a label based on the received user response; and

updating the machine learning model using the updated training set.

2. The method of claim 1, further comprising:

receiving from the second client a user response to the authentication request, wherein the user response comprises an authorization of the login request submitted by the first client; and

updating, based on the received user response, the first set of stored digital fingerprints to include the first client digital fingerprint.

3. The method of claim 1, wherein analyzing the first client digital fingerprint further comprises comparing the first client digital fingerprint to the first set of stored digital fingerprints;

wherein generating the concern metric comprises generating the concern metric based on similarity between the first client digital fingerprint and stored digital fingerprints of the first set of stored digital fingerprints.

4. The method of claim 1, wherein generating the machine learning model comprises:

identifying a second set of stored digital fingerprints associated with a second user account;

wherein the second set of stored digital fingerprints and the first set of stored digital fingerprints have no shared input features, and

generating the machine learning model trained using both of the first set and the second set of stored digital fingerprints as a training set.

5. The method of claim 4, further comprising identifying the first user account as one of a set of user accounts associated with an organization;

and selecting the second user account from the set of user accounts associated with the organization.

6. The method of claim 1, wherein the first set of stored digital fingerprints comprises digital fingerprints stored from previous authentication transactions associated with the first user account.

7. The method of claim 1, further comprising receiving authentication policy configuration data from the user;

wherein the threshold concern metric is set according to the authentication policy configuration data.

8. The method of claim 1, wherein analyzing the first client digital fingerprint further comprises analyzing device usage tracked over time, wherein analyzing device usage comprises analyzing at least one of:

application usage, communication patterns, and location.

9. The method of claim 1, wherein analyzing the first client digital fingerprint further comprises analyzing device operation, wherein analyzing device operation comprises analyzing at least one of:

a browser version, an operating system version, and a plugin version.

10. The method of claim 1, further comprising comparing the set of first client properties to a set of second client properties collected from the second client;

wherein generating the concern metric comprises generating the concern metric based on the comparing between the set of first client properties and the set of second client properties.

11. The method of claim 1, wherein generating the concern metric comprises:

generating a first check metric based on the analyzing of the first client digital fingerprint;

in response to the first check metric being below a first check metric threshold, comparing the set of first client properties to a set of second client properties collected from the second client; and

generating the concern metric based on both of the analyzing of the first client digital fingerprint and the comparing between the set of first client properties and the set of second client properties.

12. The method of claim 1, wherein the suggested authorization options include at least one of:

an option to reset authentication credentials associated with the first user account, an option to lock the first user account, and a notify option to notify a third party of attempted unauthorized account access.

13. A method for multi-factor authentication with a first client operating on a first client device, comprising:

receiving a login request, the login request associated with a first user account, from the first client;

in response to receiving the login request, initiating an authentication transaction;

identifying a second client, the second client operating on a second client device, from data associated with the first user account;

generating a first client digital fingerprint from a set of first client properties collected from the first client;

generating a second client digital fingerprint from a set of second client properties collected from the second client;

generating a machine learning model trained using the set of first client properties and the set of second client properties as a training set;

comparing, using the machine learning model, the first client digital fingerprint to the second client digital fingerprint;

generating a concern metric based on the comparing of the first client digital fingerprint and the second client digital fingerprint;

in response to the concern metric exceeding a threshold concern metric, providing to the second client an authentication request notifying a user that the login request from the first client may have originated from an unauthorized source, wherein the authentication request to the second client comprises

     1) a display of the concern metric comprising a probability value that the login request by the first client is unauthorized and

     2) one or more suggested authorization options, wherein content of the suggested authorization options is determined based on degree of the concern metric;

receiving a user response to the authentication request, wherein the user response comprises one of an authorization or denial of the login request;

updating the training set to include the generated first client digital fingerprint and a label based on the received user response; and

updating the machine learning model using the updated training set.

14. The method of claim 13, wherein comparing the first client digital fingerprint to the second client digital fingerprint comprises comparing at least one of:

browser version, operating system version, and plugin version.

15. The method of claim 13, wherein the suggested authorization options include at least one of:

an option to reset authentication credentials associated with the first user account, an option to lock the first user account, and a notify option to notify a third party of attempted unauthorized account access.