SYSTEM AND METHOD FOR ADAPTIVE APPLICATION OF AUTHENTICATION POLICIES

• US 20140289790A1
• Filed: 03/18/2014
• Published: 09/25/2014
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Wilson, Brendon
• Granted Patent: US 10,776,464 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication

Abstract

A system, apparatus, method, and machine readable medium are described for adaptively implementing an authentication policy. For example, one embodiment of a method comprises: detecting a user of a client attempting to perform a current interaction with a relying party; and responsively identifying a first interaction class for the current interaction based on variables associated with the current interaction and implementing a set of one or more authentication rules associated with the first interaction class.

Claims

1. A method for user authentication comprising:

detecting a user of a client attempting to perform a current interaction with a relying party; and

responsively identifying a first interaction class for the current interaction based on variables associated with the current interaction and implementing a set of one or more authentication rules associated with the first interaction class.

2. The method as in claim 1 further comprising:

initially defining a plurality of interaction classes for the relying party, the interaction classes defined based on variables associated with interactions between the client and the relying party; and

initially defining a set of one or more authentication rules specifying authentication devices or classes of authentication devices to be used for different interaction classes.

3. The method as in claim 2 further comprising:

initially defining a plurality of authentication device classes based on one or more characteristics of client authentication devices; and

initially classifying a plurality of authentication device models into the plurality of authentication device classes based on characteristics of the authentication device models.

4. The method as in claim 3 wherein implementing a set of one or more authentication rules comprises implementing a first rule specifying a particular authentication device class required to authenticate the user for the current interaction.

5. The method as in claim 4 wherein the first rule comprises a prioritized list of acceptable authentication device classes for the current interaction.

6. The method as in claim 5 wherein the client selects a first authentication device to be used for authentication based on the prioritized list of acceptable authentication device classes.

7. The method as in claim 1 wherein the variables associated with the current interaction comprises an amount of money or the sensitivity of data involved in the current interaction.

8. The method as in claim 3 wherein the characteristics of client authentication devices used for classification into an authentication device class include a type of authentication device, a level of security assurance of the client device'"'"'s hardware and/or software, a type of location in which secrets are stored, and/or a type of location where cryptographic operations are performed by the authentication devices.

9. The method as in claim 8 wherein the type of authentication device includes fingerprint authentication, PIN or password entry, face recognition authentication, voice recognition authentication, authentication using a trusted platform module (TPM) device, and/or retinal scanning authentication.

10. The method as in claim 3 wherein at least one authentication device class is defined to have a particular authentication factor with a false acceptance rate below a specified threshold.

11. The method as in claim 3 wherein at least one authentication device class is defined based on where and/or how a matching algorithm is implemented to match biometric data extracted from an authentication device with biometric template data stored in a secure storage.

12. The method as in claim 11 wherein the authentication device class is defined based on the matching algorithm being, or not being implemented within a secure execution environment.

13. The method as in claim 10 wherein the one authentication device class is further defined to store sensitive data in cryptographically secure hardware and/or software.

14. The method as in claim 6 further comprising:

generating an assurance level based, at least in part, on a user authentication with the first authentication device.

15. The method as in claim 14 wherein the interaction is permitted if the assurance level is above a specified threshold.

16. The method as in claim 15 wherein the assurance level is generated, at least in part, based on current sensor data read from client sensors, wherein at least one of the sensors comprises a location sensor providing a current location of the client.

17. An authentication system comprising:

an authentication policy database to store authentication policies for a relying party;

a relying party to detect a user of a client attempting to perform a current interaction;

the relying party to responsively query the authentication policy database to identify a first interaction class for the current interaction based on variables associated with the current interaction and to implement a set of one or more authentication rules associated with the first interaction class.

18. The authentication system as in claim 17 wherein the relying party is to perform the additional operations of:

initially defining a plurality of interaction classes in the authentication policy database, the interaction classes defined based on variables associated with interactions between the client and the relying party; and

initially defining a set of one or more authentication rules in the authentication policy database specifying authentication devices or classes of authentication devices to be used for different interaction classes.

19. The authentication system as in claim 18 further comprising:

initially defining a plurality of authentication device classes in the authentication policy database based on one or more characteristics of client authentication devices; and

initially classifying a plurality of authentication device models into the plurality of authentication device classes in the authentication policy database based on characteristics of the authentication device models.

20. The authentication system as in claim 19 wherein implementing a set of one or more authentication rules comprises implementing a first rule specifying a particular authentication device class required to authenticate the user for the current interaction.

21. The authentication system as in claim 20 wherein the first rule comprises a prioritized list of acceptable authentication device classes for the current interaction.

22. The authentication system as in claim 21 wherein the client selects a first authentication device to be used for authentication based on the prioritized list of acceptable authentication device classes.

23. The authentication system as in claim 17 wherein the variables associated with the current interaction comprises an amount of money or the sensitivity of data involved in the current interaction.

24. The authentication system as in claim 19 wherein the characteristics of client authentication devices used for classification into an authentication device class include a type of authentication device, a level of security assurance of the client device'"'"'s hardware and/or software, a type of location in which secrets are stored, and/or a type of location where cryptographic operations are performed by the authentication devices.

25. The authentication system as in claim 24 wherein the type of authentication device includes fingerprint authentication, PIN or password entry, face recognition authentication, voice recognition authentication, authentication using a trusted platform module (TPM) device, and/or retinal scanning authentication.

26. The authentication system as in claim 19 wherein at least one authentication device class is defined to have a particular authentication factor with a false acceptance rate below a specified threshold.

27. The authentication system as in claim 19 wherein at least one authentication device class is defined based on where and/or how a matching algorithm is implemented to match biometric data extracted from an authentication device with biometric template data stored in a secure storage.

28. The method as in claim 27 wherein the authentication device class is defined based on the matching algorithm being, or not being implemented within a secure execution environment.

29. The authentication system as in claim 26 wherein the one authentication device class is further defined to store sensitive data in cryptographically secure hardware and/or software.

30. The authentication system as in claim 22 further comprising:

the client generating an assurance level based, at least in part, on a user authentication with the first authentication device.

31. The authentication system as in claim 30 wherein the interaction is permitted if the assurance level is above a specified threshold.

32. The authentication system as in claim 31 wherein the assurance level is generated, at least in part, based on current sensor data read from client sensors, wherein at least one of the sensors comprises a location sensor providing a current location of the client.