Multi-Factor Profile and Security Fingerprint Analysis

• US 20130055367A1
• Filed: 09/12/2012
• Published: 02/28/2013
• Est. Priority Date: 08/25/2011
• Status: Active Grant

• Current Assignee: T-Mobile USA, Inc. (Deutsche Telekom AG)
• Original Assignee: T-Mobile USA, Inc. (Deutsche Telekom AG)
• Inventors: Giard, Jeffrey M., Goo, Michael J., Sandidge, Tony A., Schuler, Seth H., Subramanian, Bala, Kshirsagar, Vinay, Kong, Xianglong, Zhao, Linda
• Granted Patent: US 9,824,199 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A security fingerprint architecture is disclosed. A security fingerprint comprises one or more behavioral factors which store a history of events associated with one or more users. The data in the security fingerprint is exposed by one or more modes, each of which determines the conditions that data in the security fingerprint may be accessed. Security fingerprints support a number of primitive operations that allow set operations to be performed. Security fingerprints may be used in for authentication, advertising, and other operations either alone, or in conjunction with third party data sources. An exemplary platform of security fingerprints built upon a cellular infrastructure is also disclosed.

Claims

1. A method to generate an identity fingerprint, comprising:

retrieving at least one record from a data store of records based at least on a profile corresponding to one or more users, the profile comprising a specification of records from the data store, and the records relating to historical activities of the one or more users; and

converting the at least one retrieved record into a set of data; and

generating an identity fingerprint from the converted set of data.

2. The method of claim 1, wherein the profile further comprises a specification of access restrictions associated with the set of data, the access restrictions exposing at least a part of the set of data for querying.

3. The method of claim 1, wherein the profile enumerates at least one data field, the data field comprising a data field identifier and an indicator of whether the user has enabled the data field to be exposed by a query applied to the generated identity fingerprint.

4. The method of claim 1, wherein the generated identity fingerprint comprises a plurality of selectable modes, each mode associated with a different set of access restrictions for exposing at least a part of the set of data for querying.

5. The method of claim 4, wherein the profile specifies at least one of the plurality of modes.

6. The method of claim 1, wherein the profile specifies what data sources are to be used in maintaining the data store.

7. The method of claim 6, wherein at least one of the data sources comprises a data source identifier and an indicator whether the user has enabled the data source to be used in maintaining the data store.

8. The method of claim 6, wherein at least one of the data sources to be used in maintaining the data store is any one or more of:

cellular activity data; and

cellular plan data.

9. The method of claim 1, wherein the generating the identity fingerprint comprises compressing the set of data.

10. The method of claim 1, wherein the generating the identity fingerprint comprises encrypting the set of data.

11. A system to selectively present a set of data, comprising:

a processor;

a memory;

an identity fingerprint stored in the memory, the identity fingerprint including;

a set of data,

a plurality of modes, each mode specifying a subset of the set of data that is exposed for querying, and

a mode selector operable to select one of the plurality of modes;

and

a primitive operator stored in the memory and executable by the processor to receive at least the identity fingerprint, and perform any one or more of the following;

generate a value, from the identity fingerprint;

transform the identity fingerprint;

or

generate one or more other identity fingerprints.

12. The system of claim 11, further comprising a query engine stored in the memory,

wherein the primitive operator is a query, such that the query engine is operable to retrieve at least a portion of the set of data of the identity fingerprint based at least in part on the query.

13. The system of claim 12, wherein the identity fingerprint comprises one or more filters operable to limit data retrieved by the query engine.

14. The system of claim 13, wherein the one or more filters are implemented as modes, and wherein the query is associated with a querying identity and the mode selector is operable to dynamically select a mode at query time based on the querying identity.

15. The system of claim 11, comprising a second identity fingerprint, and

wherein the primitive operator is an aggregation operator, such that the processor is operable to create a merged identity fingerprint comprising:

a set of data comprising a non-duplicative combination of a set of data from the identity fingerprint and a set of data from the second identity fingerprint,

a plurality of modes comprising a non-duplicative combination of a plurality of modes from the identity fingerprint and a plurality of modes from the second identity fingerprint, and

a mode selector.

16. The system of claim 11, wherein the primitive operator is a disaggregation operator, such that the processor is operable to create at least one disaggregated identity fingerprint comprising:

a set of data comprising a subset of the set of data from the identity fingerprint,

at least one mode of the plurality of modes from the identity fingerprint, and

a mode selector.

17. The system of claim 11, wherein the primitive operator is a replication operator, such that the processor is operable to create another identity fingerprint comprising:

another set of data substantially identical to the set of data,

another plurality of modes substantially identical to the plurality of modes, and

another mode selector.

18. The system of claim 11, wherein the identity fingerprint further comprises:

an indicator of a version of the identity fingerprint; and

an indicator whether the identity fingerprint is a complete identity fingerprint or whether the identity fingerprint is a difference between two fingerprints.

19. The system of claim 18, further comprising a first identity fingerprint that is a complete identity fingerprint and a second identity fingerprint that is a delta,

wherein the primitive operation is an update operation, such that the processor is operable create a third identity fingerprint, the third identity fingerprint comprising:

a set of data comprising a non-duplicative combination of a set of data from the first identity fingerprint and a set of data from the second identity fingerprint,

a plurality of modes comprising a non-duplicative combination of a plurality of modes from the first identity fingerprint and a plurality of modes from the second identity fingerprint, and

a mode selector.

20. The system of claim 11, wherein the primitive operation is a locking operation, such that the processor is operable to prevent any of the set of data from being retrieved.

21. The system of claim 11, further comprising a second identity fingerprint,

wherein the primitive operation is a comparison operation, such that the processor is operable to apply a similarity scoring operation to the set of data in the identity fingerprint with respect to a set of data in the second identity fingerprint, to apply a similarity scoring operation to the plurality of modes in first identity fingerprint with respect to a plurality of modes in the second identity fingerprint, and to return the resulting similarity scores.

22. A method to generate an identity fingerprint, comprising:

retrieving records corresponding to a memory impaired patient from a data store of records based on a profile corresponding to the memory impaired patient, the profile comprising a specification of a first mode for a patient, a second mode for a family member, and a third mode for a medical caregiver;

encrypting the retrieved records into a set of data such that the that the set of data configured to be selectively queried according to at least one of the first, second, or third modes; and

generating an identity fingerprint based at least in part on the set of data and the first, second, and third modes.

23. A method to calculate a confidence score during an authentication operation, comprising:

receiving indicia of user activity and a security fingerprint;

identifying a confidence score associated with the security fingerprint, the confidence score associated with one or more factors;

retrieving from the security fingerprint confidence score factors available from the security fingerprint;

identifying third party data sources for confidence score factors not available from the security fingerprint;

retrieving from the identified third party data sources confidence score factors not available from the security fingerprint; and

calculating the confidence score using at least one confidence score factor retrieved from the security fingerprint and one confidence score factor retrieved from an identified third party data source.

24. The method of claim 23 wherein the identifying third party data sources for confidence score factors is performed only if a predetermined condition is satisfied.

25. A method of generating an aggregated security fingerprint, comprising:

receiving a target profile comprising of one or more behavioral factors, each associated with a respective value range;

receiving a condition upon which aggregation is to be performed;

receiving a notification that the condition has been satisfied;

responsive to the notification, querying a security profile data store for one or more security fingerprints satisfying the target profile, and aggregating the retrieved security fingerprints into a single aggregated security fingerprint.

26. A method of generating a security fingerprint supporting conditional queries, comprising:

receiving one or more security fingerprints;

extracting behavioral factors from the one or more security fingerprints according to a predetermined heuristic, the heuristic associated with a confidence level; and

generating a security fingerprint from at least some of the behavior factors and the confidence score, such that the behavioral factors may be queried based at least in part of the confidence level.

27. A method of conditionally querying a security fingerprint, comprising:

receiving a security fingerprint, the security fingerprint comprising one or more behavioral factors and a confidence level;

receiving a query associated with a query confidence level; and

if the query confidence level meets or exceeds the confidence level of the security fingerprint, retrieving the behavioral factors according to the query, and otherwise if the query confidence level does not meet or exceed the confidence level of the security fingerprint, returning an error message.