Challenge-response authentication based on internet of things information

Patent metadata

Field	Value
Publication number	US-10231122-B2
Application number	US-201514696797-A
Country	US
Kind code	B2
Filing date	Apr 27, 2015
Priority date	Apr 27, 2015
Publication date	Mar 12, 2019
Grant date	Mar 12, 2019

Abstract

Approaches presented herein enable challenge-response authentication of a user based on information captured by a personal internet of things (IoT) device set associated with the user. Specifically, in one approach, a personal IoT device set comprising at least one device records and stores data associated with a user. The data is synchronized and stored to a computerized authentication system, which prompts the user with an authentication question based on the synchronized and stored data. The user may find an answer to the authentication question by reviewing data recorded and stored in the device of the personal IoT device set. The user may then enter the found answer to the authentication question, thereby authenticating the user. The personal IoT device set may comprise a single device or may comprise a plurality of devices, the information of one of which may be selected as the basis of the authentication question.

First claim

What is claimed is:

1. A computer-implemented method for authenticating a user, the method comprising:
identifying a plurality of internet of things devices identified with a user, the devices of the plurality of internet of things devices being devices of the user forming a personal internet of things that each dynamically track and capture information data points describing an activity of the user over a period of time, wherein each of the plurality of internet of things devices is configured to store on that device a data log in a human-readable format of the captured information data points that is accessible by a human using that device;
receiving a request initiated by a party claiming to be the user to authenticate the party as the user;
requesting, responsive to the received request, the requesting party to select at least one device of the plurality of internet of things devices as having a data log that is currently accessible to the requesting party;
receiving, responsive to the requested selection, a designation from the requesting party of at least one device of the plurality of internet of things devices as currently accessible to the requesting party, the designated at least one device being configured to permit the requesting party to review the data log on the device to find a previous data point;
retrieving, from the designated internet of things device, a set of the captured dynamically tracked information data points of the user tracked over a period of time by the designated device;
generating a user identity-authenticating question in a natural language, the answer to which is a randomly selected information data point from the set of retrieved dynamically tracked information data points of the user on the at least one device designated as accessible to the requesting party, wherein the randomly selected information data point is only discoverable to the requesting party by the designated device displaying the captured dynamically tracked information data points in the data log on a screen of the designated device, and wherein a correct answer to the user identity-authenticating question corresponds to the randomly selected information point tracked with the designated internet of things device;
prompting the requesting party to find the information data point on the designated device by presenting the user identity-authenticating question to the requesting party in a natural language, the information data point being the answer to the user identity-authenticating question;
obtaining an answer to the user identity-authenticating question in a natural language from the requesting party; and
authenticating the requesting party as the user in the case that the requesting party returns the correct answer to the user identity-authenticating question.

2. The method of claim 1 , wherein the data point tracked by the plurality of internet of things devices is a personal metric corresponding to the user, and wherein at least one of the devices of the plurality of internet of things devices dynamically tracks and captures a metric that is not a biometric or a location of the user.

3. The method of claim 1 , wherein in the case that the requesting party returns an incorrect answer to the authentication question, the method further comprises:
determining a second authentication question based on the information of the user and a second device of the plurality of internet of things devices designated as accessible to the requesting party; and
prompting the requesting party with the second authentication question.

4. The method of claim 1 , further comprising:
comparing the information of the user to a historical information of the user tracked by the plurality of internet of things devices of the user; and
lowering a confidence of a user authentication if the comparison is outside of a pre-determined threshold of expected information values for the user.

5. The method of claim 1 , further comprising receiving a registration of a plurality of internet of things devices from the user, wherein the user designates a subset of the registered plurality of devices as currently accessible devices to the user.

6. The method of claim 1 , wherein the at least one device designated as accessible to the requesting party comprises a plurality of devices designated as accessible to the requesting party, the method further comprising selecting one of the designated as accessible devices on which to base the authentication question, the selecting being based on at least one of: a human factor, an ease of access, dynamically tracked information stored on the device, security, a recentness of data, and a random selection.

7. The method of claim 1 , wherein the authentication question is at least one of: a primary authentication, a supplementary authentication, a challenge authentication, and an unusual activity authentication.

8. A computer system for authenticating a user, the computer system comprising:
a memory medium comprising program instructions;
a bus coupled to the memory medium; and
a processor, for executing the program instructions, coupled to a challenge-response authentication tool via the bus that when executing the program instructions causes the system to:
identify a plurality of internet of things devices identified with a user, the devices of the plurality of internet of things devices being devices of the user forming a personal internet of things that each dynamically track and capture information data points describing an activity of the user over a period of time, wherein each of the plurality of internet of things devices is configured to store on that device a data log in a human-readable format of the captured information data points that is accessible by a human using that device;
receive a request initiated by a party claiming to be the user to authenticate the party as the user;
request, responsive to the received request, the requesting party to select at least one device of the plurality of internet of things devices as having a data log that is currently accessible to the requesting party;
receive, responsive to the requested selection, a designation from the requesting party of at least one device of the plurality of internet of things devices as currently accessible to the requesting party, the designated at least one device being configured to permit the requesting party to review the data log on the device to find a previous data point;
retrieve, from the designated internet of things device, a set of the captured dynamically tracked information data points of the user tracked over a period of time by the designated device;
generate a user identity-authenticating question in a natural language, the answer to which is a randomly selected information data point from the set of retrieved dynamically tracked information data points of the user on the at least one device designated as accessible to the requesting party, wherein the randomly selected information data point is only discoverable to the requesting party by the designated device displaying the captured dynamically tracked information data points in the data log on a screen of the designated device, and wherein a correct answer to the user identity-authenticating question corresponds to the randomly selected information point tracked with the designated internet of things device;
prompt the requesting party to find the information data point on the designated device by presenting the user identity-authenticating question to the requesting party in a natural language, the information data point being the answer to the user identity-authenticating question;
obtain an answer to the user identity-authenticating question in a natural language from the requesting part

Assignees

• IBM

Inventors

• Childress Rhonda L
• Goldberg Itzhack
• Mizrachi Boaz
• Pickover Clifford A
• Sondhi Neil

Classifications

• G06F21/31

  User authentication · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04W12/06 Primary

  Authentication · CPC title