Using tokens from push notification providers to enhance device fingerprinting

Patent metadata

Field	Value
Publication number	US-11831641-B2
Application number	US-202117233769-A
Country	US
Kind code	B2
Filing date	Apr 19, 2021
Priority date	Apr 19, 2021
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

Embodiments disclosed are directed to a system that performs steps to perform enhanced device fingerprinting. The system at least at receives from an application, a plurality of device attributes identifying a client device on which the application is being used. The plurality of device attributes includes a push token provided by a push token service to the client device. The push token is uniquely paired to the client device. The system further transmits, to a device database, the plurality of device attributes for storage in a device profile. The system also transmits, to the application, a push notification based on the push token. The system receives, from the application, a deliverable status indicating whether the push notification was successfully transmitted to the client device, and transmits, to a notification database, the deliverable status for storage in a notification delivery profile. The system can use the information to authenticate a device.

First claim

What is claimed is:

1. A computer implemented method for enhanced device fingerprinting, the method comprising:
at a first time:
(a) receiving, by one or more computing devices and from an application, a plurality of device attributes identifying a client device on which the application is being used, wherein the plurality of device attributes includes a push token provided by a push service to the client device, and wherein the push token is uniquely paired to the client device,
(b) transmitting, by the one or more computing devices and to a device database, the plurality of device attributes for storage in a device profile,
(c) transmitting, by the one or more computing devices and to the application, a push notification based on the push token,
(d) receiving, by the one or more computing devices and from the application, a deliverable status indicating whether the push notification was successfully transmitted to the client device,
(e) transmitting, by the one or more computing devices and to a notification database, the deliverable status for storage in a notification profile; and

at a second time:
(f) receiving, by the one or more computing devices and from the application, an indication that a user is attempting to perform a high-risk transaction using the application,
(g) based on the indication, requesting, by the one or more computing devices, a further plurality of device attributes to identify a device on which the application is being used,
(h) based on the request in (g), receiving, by the one or more computing devices, the further plurality of device attributes,
(i) comparing, by the one or more computing devices and by performing a pairwise comparison, the further plurality of device attributes to:
the plurality of device attributes received in (a), and
the deliverable status received in (d); and

(j) based on the comparison in (i), determining, by the one or more computing devices, a device risk score, wherein the device risk score indicates whether the user is authorized to perform the high-risk transaction.

2. The computer implemented method of claim 1 , further comprising authorizing, by the one or more computing devices, the user to perform the high-risk transaction if the device risk score is equal to or greater than a first threshold value.

3. The computer implemented method of claim 2 , further comprising performing, by the one or more computing devices, additional authentication to determine whether to authorize the user to perform the high-risk transaction if the device risk score is equal to or greater than a second threshold value and is less than the first threshold value.

4. The computer implemented method of claim 3 , further comprising preventing, by the one or more computing devices, the user from performing the high-risk transaction if the device risk score is less than the second threshold value.

5. The computer implemented method of claim 3 , wherein performing the additional authentication includes:
transmitting a further push notification to the device on which the application is being used in (g), wherein the further push notification includes an embedded secret;
receiving, from the device, the embedded secret; and
based on receiving the embedded secret from the device, authorizing the user to perform the high-risk transaction.

6. The computer implemented method of claim 3 , wherein performing the additional authentication includes:
transmitting a further push notification to the device on which the application is being used in (g), wherein the further push notification includes an embedded secret;
receiving, from the device, a processed version of the embedded secret;
determining whether the processed version of the embedded secret matches an expected value; and
authorizing the user to perform the high-risk transaction if the processed version of the embedded secret matches the expected value.

7. The computer implemented method of claim 1 , further comprising:
repeating (a)-(e) over a period of time to:
accumulate, in the device profile, a first multitude of values including the plurality of device attributes received in (a),
accumulate, in the notification profile, a second multitude of values including the deliverable status received in (d); and

comparing, by the one or more computing devices and by performing a pairwise comparison,
the further plurality of device attributes to:
the first multitude of values, and
the second multitude of values; and

based on the comparison, determining the device risk score.

8. A non-transitory computer readable medium including instructions for causing a processor to perform operations for enhanced device fingerprinting, the operations comprising:
at a first time:
(a) receiving, by one or more computing devices and from an application, a plurality of device attributes identifying a client device on which the application is being used, wherein the plurality of device attributes includes a push token provided by a push service to the client device, and wherein the push token is uniquely paired to the client device,
(b) transmitting, by the one or more computing devices and to a device database, the plurality of device attributes for storage in a device profile,
(c) transmitting, by the one or more computing devices and to the application, a push notification based on the push token,
(d) receiving, by the one or more computing devices and from the application, a deliverable status indicating whether the push notification was successfully transmitted to the client device,
(e) transmitting, by the one or more computing devices and to a notification database, the deliverable status for storage in a notification profile; and

at a second time:
(f) receiving, by the one or more computing devices and from the application, an indication that a user is attempting to perform a high-risk transaction using the application,
(g) based on the indication, requesting, by the one or more computing devices, a further plurality of device attributes to identify a device on which the application is being used,
(h) based on the request in (g), receiving, by the one or more computing devices, the further plurality of device attributes,
(i) comparing, by the one or more computing devices and by performing a pairwise comparison, the further plurality of device attributes to:
the plurality of device attributes received in (a), and
the deliverable status received in (d);

(j) based on the comparison in (i), determining, by the one or more computing devices, a device risk score, wherein the device risk score indicates whether the user is authorized to perform the high-risk transaction; and
(k) authorizing, by the one or more computing devices, the user to perform the high-risk transaction if the device risk score is equal to or greater than a first threshold value.

9. The non-transitory computer readable medium of claim 8 , wherein the operations further comprise performing, by the one or more computing devices, additional authentication to determine whether to authorize the user to perform the high-risk transaction if the device risk score is equal to or greater than a second threshold value and is less than the first threshold value.

10. The non-transitory computer readable medium of claim 9 , wherein the operations further comprise preventing, by the one or more computing devices, the user from performing the high-risk transaction if the device risk score is less than the second threshold value.

11. The non-transitory computer readable medium of claim 9 , wherein the operations further comprise performing the additional authentication by:
transmitting a further push notification to the

Assignees

• Capital One Services Llc

Inventors

• Jarvis Daniel Alan
• Zearfoss Patrick
• Haq Salman

Classifications

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/102

  Entity profiles · CPC title