Managing access to services based on fingerprint matching

Patent metadata

Field	Value
Publication number	US-11038876-B2
Application number	US-201916241504-A
Country	US
Kind code	B2
Filing date	Jan 7, 2019
Priority date	Jun 9, 2017
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

A method includes: receiving a request regarding access by a first computing device (e.g., a mobile device of a user) to a service; in response to the request, performing, by a second computing device (e.g., a device risk evaluation server, or a server of an identity provider), an evaluation that includes creating a fingerprint of the first computing device; and determining, by the second computing device, whether the fingerprint matches a fingerprint of one or more other computing devices. The second computing devices determines whether to authorize access to the service based on the evaluation.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a first computing device, a request from a second computing device, wherein the request is for access by the second computing device to a service, and wherein access to the service requires that a software component is installed on the second computing device;
in response to the request, determining whether the software component is installed on the second computing device;
in response to determining that the software component is not installed on the second computing device, creating a fingerprint of the second computing device, the fingerprint including network behavior information, the network behavior information including data from an evaluation that runs at least one behavioral test on at least one network to which the second computing device connects to determine whether the second computing device is sending at least one vulnerable communication to at least one unknown computing device, a network communication path between the first computing device and the second computing device, and further including communications by the second computing device with other computing devices; and
determining whether the fingerprint matches a fingerprint of a different computing device that has previously communicated with the first computing device.

2. The method of claim 1 , wherein the fingerprint further includes data extracted from at least one communication received by the first computing device from the second computing device.

3. The method of claim 1 , further comprising:
performing, by the first computing device, an evaluation of a configuration of the second computing device, wherein the evaluation comprises determining whether the fingerprint matches the fingerprint of the different computing device, and further comprises determining a risk level; and
performing, by the first computing device, an action based on the evaluation, wherein the action comprises sending a first communication to a computing device, the first communication indicating the risk level.

4. The method of claim 3 , wherein access to the service further requires authorization by a computing device of an identity provider, the method further comprising:
receiving data in a communication from the computing device of the identity provider;
wherein the evaluation is based at least in part on the received data from the identity provider.

5. The method of claim 3 , wherein access to the service further requires authorization by a computing device of an identity provider, and wherein the first communication is sent to the computing device of the identity provider.

6. The method of claim 3 , wherein:
the service is provided by a third computing device; and
an extent of access to the service provided to the second computing device is based on the risk level.

7. The method of claim 3 , wherein software on the second computing device is used to access the service, and the evaluation further comprises determining a source of the software.

8. The method of claim 3 , wherein the evaluation further comprises evaluating hardware-backed authentication in which the second computing device signs, using a hardware-stored key, a nonce provided by the first computing device.

9. The method of claim 3 , further comprising:
determining a location of the second computing device;
wherein the evaluation is based at least in part on the location.

10. The method of claim 3 , further comprising:
monitoring a plurality of computing devices; and
detecting a type of event associated with a number of the plurality of computing devices;
wherein the risk level is based at least in part on the number of the plurality of computing devices.

11. The method of claim 3 , wherein the evaluation determines that the configuration is not secure, and the action further comprises blocking access of the second computing device to the service.

12. The method of claim 1 , further comprising:
generating a token for the second computing device, the token comprising data encoding the risk level; and
providing the token to the second computing device.

13. The method of claim 1 , wherein the request for access to the service is generated by an application executing on the second computing device, the method further comprising:
performing, by the first computing device, an evaluation of a configuration of the second computing device, wherein the evaluation comprises determining an authenticity of the application.

14. The method of claim 1 , further comprising:
sending a second communication to the second computing device requesting installation of the software component; and
in response to determining that the software component is installed on the second computing device, sending a communication to cause a third computing device to grant the access by the second computing device to the service.

15. A system, comprising:
at least one processor of a first computing device; and
memory storing instructions configured to instruct the at least one processor to:
receive a request from a second computing device, wherein the request is for access by the second computing device to a service, and wherein access to the service requires that a software component is installed on the second computing device;
in response to the request, determine whether the software component is installed on the second computing device;
create a fingerprint of the second computing device, the fingerprint including network behavior information, the network behavior information including data from an evaluation that runs at least one behavioral test on at least one ach network to which the second computing device connects to determine whether the second computing device is sending at least one vulnerable communication to at least one unknown computing device, a network communication path between the first computing device and the second computing device, and communications by the second computing device with other computing devices; and
in response to determining that the software component is not installed on the second computing device, determine whether the fingerprint matches a fingerprint of a different computing device that has previously communicated with the first computing device.

16. The system of claim 15 , wherein:
software on the first computing device is used to access the service;
the instructions are further configured to instruct the at least one processor to perform an evaluation of the second computing device; and
the evaluation comprises determining a source of the software.

17. The system of claim 15 , wherein access to the service further requires authorization by a computing device of an identity provider, and the instructions are further configured to instruct the at least one processor to:
receive data in a communication from the computing device of the identity provider; and
perform an evaluation of the second computing device, the evaluation including determining whether the fingerprint matches the fingerprint of the different computing device;
wherein the evaluation of the second computing device is based at least in part on the received data from the identity provider.

18. The system of claim 15 , wherein the service is provided by a third computing device, and an extent of access to the service provided to the second computing device is based on the risk level.

19. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a first computing device at least to:
r

Assignees

• Lookout Inc

Inventors

• Cockerill Aaron
• Richardson David
• Thanos Daniel
• Robinson William Neil
• Buck Brian James
• Mahaffey Kevin Patrick

Classifications

• H04L67/10015

  Access to distributed or replicated servers, e.g. using brokers · CPC title

• H04L67/00

  Network arrangements or protocols for supporting network services or applications (user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00) · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title