Establishing authentication persistence

Patent metadata

Field	Value
Publication number	US-11637826-B2
Application number	US-202117183888-A
Country	US
Kind code	B2
Filing date	Feb 24, 2021
Priority date	Feb 24, 2021
Publication date	Apr 25, 2023
Grant date	Apr 25, 2023

Abstract

Various embodiments are generally directed to performing an authentication persistence check and, based on the check, allowing a previously successful authentication to persist on a user apparatus. The check may involve a stability check on the user apparatus. If the user apparatus is stable, device fingerprinting on the apparatus may be performed, the result of which may be compared to a snapshot of apparatus taken at the time of successful authentication. If the comparison reveals changes or drifts that are within a predetermined threshold, then the persistence of the authentication is allowed.

First claim

What is claimed is:

1. An apparatus comprising:
a near-field communication (NFC) reader;
one or more processors operable to execute stored instructions that, when executed, cause the one or more processors to:
authenticate a user via first factor authentication;
authenticate the user via second factor authentication different from the first factor authentication, wherein the second factor authentication comprises: a contactless card being tapped to the apparatus such that NFC communication is established, receiving user authentication information from the contactless card via the NFC reader, sending the user authentication information to one or more remote computing devices, and receiving indication from the one or more remote computing devices that the user is authenticated;
determine one or more device settings of the apparatus and one or more user behavioral biometrics at a first time of the second factor authentication;
cause a stability check on the apparatus to be performed: (i) at a second time after the first time or (ii) when a authentication event occurs after the first time;
in response to the apparatus being stable, perform device fingerprinting on the apparatus to determine whether the apparatus is within a predetermined drift threshold;
in response to the apparatus being within the predetermined drift threshold, allow the second factor authentication to persist for a predetermined time period; and
in response to the apparatus not being within the predetermined drift threshold, reauthenticate the user via the second factor authentication.

2. The apparatus of claim 1 , wherein the one or more device settings includes: (i) one or more applications installed on the apparatus, (ii) one or more wireless devices connected to the apparatus via wireless connection, (iii) a list of saved wireless devices connectable to the apparatus, (iv) a network that the apparatus is connected to, (v) a list of saved networks the apparatus is connectable to, (vi) version of an operating system on the apparatus, and/or (vii) one or more setting preferences.

3. The apparatus of claim 1 , wherein the determination of the one or more user behavioral biometrics comprises the one or more processors to:
receive, via one or more sensors or one or more interfaces, user behavioral data, and
determine based on the user behavioral data: (i) how the user physically holds the apparatus, (ii) how the user swipes or interacts with a display interface, (iii) how the user uses keyboard or gestural shortcuts, (iv) how the user types words, (v) a duration of time for the user to type words, (vi) how the user transitions between two or more icons, (vii) typing speed of user, and/or (viii) typing cadence of user.

4. The apparatus of claim 1 , wherein the stability check on the apparatus comprises a mobile network operator (MNO) verification.

5. The apparatus of claim 1 , wherein the one or more device settings of the apparatus and the one or more user behavioral biometrics associated with the apparatus are unique to the user at the first time of the second factor authentication,
wherein the device fingerprinting captures a current constellation of the one or more device settings of the apparatus and the one or more user behavioral biometrics associated with the apparatus at a third time of the device fingerprinting, and
wherein the predetermined drift threshold is a threshold deviation limit of the one or more device settings and the one or more user behavioral biometrics from the first time of the second factor authentication to the third time of the device fingerprinting.

6. The apparatus of claim 1 , wherein the one or more processors are further caused to, in response to the apparatus not being stable, reauthenticate the user via both the first and second factor authentications.

7. The apparatus of claim 1 , wherein the one or more processors are further caused to:
determine a risk level of a user action to be processed or performed; and
process or perform the user action, and
wherein the predetermined drift threshold is at least dependent on the risk level of the user action.

8. A method comprising:
authenticating, via one or more processors, a user based on first factor authentication;
authenticating, via the one or more processors, the user based on second factor authentication different from the first factor authentication, wherein the second factor authentication comprises: a contactless card being tapped to an apparatus such that near field communication (NFC) is established, receiving user authentication information from the contactless card via an NFC reader, sending the user authentication information to one or more remote computing devices, and receiving indication from the one or more remote computing devices that the user is authenticated;
determining, via the one or more processors, one or more device settings of the apparatus and one or more user behavioral biometrics at a first time of the second factor authentication;
causing, via the one or more processors, a stability check on the apparatus to be performed: (i) at a second time after the first time or (ii) when a authentication event occurs after the first time;
performing, via the one or more processors, device fingerprinting on the apparatus to determine whether the apparatus is within a predetermined drift threshold in response to the apparatus being stable;
allowing, via the one or more processors, the second factor authentication to persist for a predetermined time period in response to the apparatus being within the predetermined drift threshold; and
reauthenticating, via the one or more processors, the user based on the second factor authentication in response to the apparatus not being within the predetermined drift threshold.

9. The method of claim 8 , wherein the one or more device settings includes: (i) one or more applications installed on the apparatus, (ii) one or more wireless devices connected to the apparatus via wireless connection, (iii) a list of saved wireless devices connectable to the apparatus, (iv) a network that the apparatus is connected to, (v) a list of saved networks the apparatus is connectable to, (vi) version of an operating system on the apparatus, and/or (vii) one or more setting preferences.

10. The method of claim 8 , wherein the determining of the one or more user behavioral biometrics further comprises:
receiving, via one or more sensors or one or more interfaces, user behavioral data, and
determining, via the one or more processors, based on the user behavioral data: (i) how the user physically holds the apparatus, (ii) how the user swipes or interacts with a display interface, (iii) how the user uses keyboard or gestural shortcuts, (iv) how the user types words, (v) a duration of time for the user to type words, (vi) how the user transitions between two or more icons, (vii) typing speed of user, and/or (viii) typing cadence of user.

11. The method of claim 8 , wherein the stability check on the apparatus comprises a mobile network operator (MNO) verification.

12. The method of claim 8 , wherein the one or more device settings of the apparatus and the one or more user behavioral biometrics associated with the apparatus are unique to the user at the first time of the second factor authentication,
wherein the device fingerprinting captures a current constellation of the one or more device settings of the apparatus and the one or more user behavioral biometrics associated with the apparatus at a third time of the device fingerprinting, and
wherein the predetermined drift threshold is a threshold deviation limit of the one or more device settings and the one or more user beha

Assignees

• Capital One Services Llc

Inventors

• Rule Jeffrey
• Moreton Paul
• Poole Thomas

Classifications

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04W12/71

  Hardware identity · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title