System and method for an integrity focused authentication service

• US 9,762,590 B2
• Filed: 04/16/2015
• Issued: 09/12/2017
• Est. Priority Date: 04/17/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Murphy, J. Brant
• Application Number:
  US14/688,893
• Publication Number:
  US 20150304110A1
• Time in Patent Office: 880 Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for authentication. At an authentication service, key synchronization information is stored for an enrolled authentication device for a user identifier of a service provider. The key synchronization information indicates that a private key stored by the authentication device is synchronized with a public key stored at the service provider. Responsive to an authentication request provided by the service provider for the user identifier, the authentication service determines an authentication device for the user identifier that stores a synchronized private key by using the key synchronization information, and provides the authentication request to the authentication device. The authentication service provides a signed authentication response to the service provider. The authentication response is responsive to the authentication request and signed by using the private key. The service provider verifies the signed authentication response by using the public key.

Claims

1. A method comprising:

at an authentication service;

responsive to synchronization of keys between a service provider and at least one authentication device enrolled for a user identifier of the service provider, storing key synchronization information in association with address information of the at least one authentication device, the user identifier, and authentication service account information for the service provider, the key synchronization information indicating that a private key associated with the user identifier and stored by the at least one authentication device is synchronized with a public key stored at the service provider in association with the user identifier;

receiving an authentication request provided by the service provider for a request received at the service provider from a primary device associated with the user identifier, the authentication request specifying the user identifier, wherein the authentication service is independent and external of the service provider;

mapping the authentication request to at least one authentication device identified by the key synchronization information as storing the synchronized private key to thereby identify the at least one authentication device as an intended recipient of the authentication request, wherein, as a result of the mapping, the authentication service establishes operable communication with both the service provider and the mapped at least one authentication device that is the intended recipient of the authentication request thereby allowing the authentication service to (i) route the authentication request provided by the service provider to the mapped at least one authentication device and (ii) route to the service provider, from the mapped at least one authentication device, a response to the authentication request;

providing the authentication request to the mapped at least one authentication device, wherein the authentication request provided to the mapped at least one authentication device is a request to authenticate a particular user or device on behalf of the service provider;

receiving a signed authentication response from the at least one authentication device, the signed authentication response being signed with the private key by the at least one authentication device; and

providing the signed authentication response to the service provider, the service provider verifying the signed authentication response by using the public key.

2. The method of claim 1,

wherein at least one of the authentication service, the service provider and the authentication device synchronizes the private key and the public key between the service provider and the at least one authentication device.

3. The method of claim 1, wherein:

the authentication request comprises a challenge or a prompt to a user of the at least one authentication device, and

the signed authentication response comprises a response to the challenge or prompt made by the user using the at least one authentication device.

4. A method comprising:

at an authentication service;

managing service provider key synchronization information for at least one authentication device that is enrolled at the authentication service for a user identifier of a service provider, wherein for each authentication device the key synchronization information indicates that a private key associated with the user identifier and stored by the authentication device is synchronized with a public key stored at the service provider in association with the user identifier;

responsive to an authentication request provided by the service provider for the user identifier, determining at least one authentication device for the user identifier that stores a private key that is synchronized with the service provider by using the key synchronization information, and providing the authentication request to at least one determined authentication device;

providing an authentication response signed by the at least one determined authentication device to the service provider, the authentication response being responsive to the authentication request and being signed by using the private key,

wherein the authentication request is for a request received at the service provider from a primary device associated with the user identifier, and

wherein the service provider verifies the signed authentication response by using the public key;

wherein for each determined authentication device;

keys are synchronized with the service provider during enrollment of the authentication device;

the authentication device is enrolled responsive to enrollment information provided by at least one of the authentication device, the primary device and the service provider, the enrollment information including the user identifier, address information of the authentication device, and information identifying the service provider;

an enrollment record is stored at the authentication service, the enrollment record including the address information, and the authentication service account information for the service provider identified by the enrollment information;

at least one of the authentication service, the authentication device and the service provider synchronizes the keys between the authentication device and the service provider; and

the synchronization information is stored at the authentication service in association with the enrollment record, the synchronization information indicating that the keys are synchronized between the authentication device and the service provider.

5. The method of claim 4, wherein the authentication service manages the service provider key synchronization information for each authentication device in association with address information of the authentication device, the user identifier, and authentication service account information for the service provider.

6. The method of claim 4, wherein the request received at the service provider from the primary device is at least one of a login request, a financial transaction request, a purchase transaction request, an account management request, and a service provider management request.

7. The method of claim 4,

wherein the authentication request includes encrypted data that is encrypted by the service provider by using the public key, and

wherein the at least one determined authentication device decrypts the encrypted data of the authentication request by using the private key.

8. The method of claim 4,

wherein the authentication response includes encrypted data that is encrypted by the at least one authentication device by using a public key received during enrollment of the at least one determined authentication device for the user identifier of the service provider, and

wherein the service provider decrypts the encrypted authentication response by using a private key that corresponds to the public key used by the at least one determined authentication device to encrypt the authentication response.

9. The method of claim 4, further comprising:

at the authentication service;

performing a security analysis of the signed authentication response; and

providing security information resulting from the security analysis to the service provider, the service provider using the security information to verify the signed authentication response.

10. The method of claim 9, wherein the security information indicates at least one of:

abnormal behavior patterns detected during the security analysis;

fraudulent behavior patterns detected during the security analysis; and

at least one security vulnerability assessment of the at least one determined authentication device.

11. The method of claim 4,

wherein the authentication service is a multi-factor authentication service that is external to the service provider, the service provider communicating with the multi-factor authentication service via a REST API, and

wherein the at least one determined authentication device includes an authentication application constructed to communicatively couple with the authentication service.

12. The method of claim 4, wherein the signed authentication response indicates at least one of a confirmation result, a cancellation result and a fraud result.

13. The method of claim 4,

wherein at least one of the determined authentication service, the service provider and the authentication service synchronizes the keys between the service provider and the at least one determined authentication device.

14. The method of claim 4,

wherein a plurality of authentication devices are enrolled for the user identifier at the authentication service, the plurality of authentication devices including at least a primary authentication device and at least one fallback authentication device, and

wherein the authentication service provides the authentication request to the fallback authentication device in a case where the authentication service cannot establish communication with the primary authentication device.

15. The method of claim 4,

wherein a plurality of authentication devices are enrolled for the user identifier at the authentication service, and

wherein the authentication service provides the authentication request to one or more of the plurality of authentication devices based on at least one of a user identifier profile at the authentication service and a service provider profile at the authentication service.

16. The method of claim 4,

wherein the authentication service provides the signed authentication response to the service provider in a response to the authentication request received from the service provider.

17. The method of claim 4,

wherein the authentication service provides the signed authentication response to the service provider in a response to an authentication status request received from the service provider.

18. The method of claim 4,

wherein the authentication service manages the authentication service account information for the service provider, and the service provider uses the authentication service account information to provide the authentication request to the authentication service.

19. A system comprising:

an authentication service constructed to;

manage service provider key synchronization information for at least one authentication device that is enrolled at the authentication service for a user identifier of a service provider, wherein for each authentication device the key synchronization information indicates that a private key associated with the user identifier and stored by the authentication device is synchronized with a public key stored at the service provider in association with the user identifier;

responsive to an authentication request provided by the service provider for the user identifier, determine at least one authentication device for the user identifier that stores a private key that is synchronized with the service provider by using the key synchronization information, and provide the authentication request to at least one determined authentication device;

provide an authentication response signed by the at least one determined authentication device to the service provider, the authentication response being responsive to the authentication request and being signed by using the private key,

wherein the service provider provides the authentication request responsive to a request received at the service provider from a primary device of the user identifier of the service provider, and

wherein the service provider verifies the signed authentication response by using the public key; and

the at least one determined authentication device, the at least one determined authentication device being constructed to;

store the private key; and

responsive to the authentication request;

generate an authentication response;

sign the authentication response by using the private key; and

provide the signed authentication response to the authentication service

wherein the at least one determined authentication device;

keys are synchronized with the service provider during enrollment of the authentication device;

the authentication device is enrolled responsive to enrollment information provided by at least one of the authentication device, the primary device and the service provider, the enrollment information including the user identifier, address information of the authentication device, and information identifying the service provider;

an enrollment record is stored at the authentication service, the enrollment record including the address information, and the authentication service account information for the service provider identified by the enrollment information;

at least one of the authentication service, the authentication device and the service provider synchronizes the keys between the authentication device and the service provider; and

the synchronization information is stored at the authentication service in association with the enrollment record, the synchronization information indicating that the keys are synchronized between the authentication device and the service provider.

20. The system of claim 19,

wherein the authentication request includes encrypted data that is encrypted by the service provider by using the public key, and

wherein the at least one determined authentication device decrypts the encrypted data of the authentication request by using the private key.