Collaborative risk aware authentication

Patent metadata

Field	Value
Publication number	US-11895113-B2
Application number	US-201917291090-A
Country	US
Kind code	B2
Filing date	Aug 30, 2019
Priority date	Nov 15, 2018
Publication date	Feb 6, 2024
Grant date	Feb 6, 2024

Abstract

An initiator device can broadcast a witness request to one or more authentication devices. The one or more authentication devices can then determine an assurance level from a range of assurance levels and determine a token share corresponding to the assurance level. The initiator device can then receive, from the one or more authentication devices, at least one witness response comprising the token share corresponding to the assurance level. The initiator device can generate an authentication token using a set of token shares. The initiator device can then transmit the authentication token to an authentication server, wherein the authentication server verifies the authentication token.

First claim

What is claimed is:

1. A method comprising:
broadcasting, by an initiator device, a witness request to a plurality of authentication devices, wherein the plurality of authentication devices determine one or more assurance levels with respect to the initiator device, respectively, from a range of assurance levels and determine a token share corresponding to the one or more assurance levels, respectively;
receiving, by the initiator device from the plurality of authentication devices, a plurality of witness responses comprising a set of token shares corresponding to an assurance level among the one or more assurance levels, wherein each of the token shares is a portion of an authentication token or determined using a key share that is a fraction of a cryptographic key;
generating, by the initiator device, the authentication token, by using the token shares of the set; and
transmitting, by the initiator device, the authentication token to an authentication server, wherein the authentication server verifies the authentication token.

2. The method of claim 1 , wherein each of the plurality of witness responses further comprises at least one assurance level among the one or more assurance levels.

3. The method of claim 1 , wherein the witness request specifies one or more requested assurance levels, and wherein the one or more requested assurance levels include the assurance level corresponding to the set of token shares.

4. The method of claim 1 , wherein the set of token shares is associated with a first assurance level of the range of assurance levels, and wherein the method further comprises:
determining a first amount of the yet of token shares of the set of token shares; and
determining, by the initiator device, the first assurance level associated with the set of token shares that include at least a threshold amount of token shares by comparing the first amount to the threshold amount.

5. The method of claim 4 , wherein the first amount of the set of token shares is determined by summing weights of the set of token shares, wherein a higher value for a weight indicates the token share is more secure.

6. The method of claim 4 , further comprising:
obtaining, by the initiator device, an initiator token share corresponding to the first assurance level and any other token share(s) when lower assurance levels exist.

7. The method of claim 4 , wherein the token shares are included in a plurality of token shares corresponding to the one or more assurance levels, the first assurance level includes one or more first assurance levels respectively associated with one or more sets of token shares, and wherein the authentication token is one or more authentication tokens.

8. The method of claim 4 further comprising:
transmitting, by the initiator device, the first assurance level to the authentication server.

9. The method of claim 1 , further comprising:
prior to broadcasting the witness request, receiving, by the initiator device, a challenge request from the authentication server.

10. The method of claim 9 , wherein the authentication server generates the challenge request after receiving authentic credentials from a user device.

11. The method of claim 9 , wherein the challenge request is received from the authentication server via a user device.

12. The method of claim 1 , wherein generating the authentication token further comprises:
removing, by the initiator device, duplicate token shares from the set of token shares; and
XORing, by the initiator device, remaining token shares from the set of token shares to determine the authentication token.

13. The method of claim 1 , further comprising:
prior to broadcasting the witness request, determining, by the initiator device, the witness request based on at least one of user input, an internal timer, and a detection of an anomaly.

14. A method comprising:
receiving, by an authentication device from an initiator device, a witness request;
determining, by the authentication device, a first assurance level with respect to the initiator device based on a trust score, the first assurance level determined from a range of assurance levels;
obtaining, by the authentication device, a token share corresponding to the first assurance level, wherein the token share is one of a plurality of token shares associated with a plurality of authentication devices, respectively, wherein each of the plurality of token shares is a portion of an authentication token or determined using a key share that is a fraction of a cryptographic key, and wherein the plurality of token shares results are used in generation of the authentication token; and
transmitting, by the authentication device to the initiator device, the token share for the first assurance level.

15. The method of claim 14 , wherein obtaining the token share further comprises:
obtaining, by the authentication device, other token share(s) corresponding to lower assurance levels when assurance levels lower than the first assurance level exist.

16. The method of claim 15 , wherein transmitting the token share further comprises:
transmitting, by the authentication device, the other token share(s) for each of the lower assurance level.

17. The method of claim 16 , wherein obtaining the token share corresponding to the first assurance level and the other token share(s) corresponding to the lower assurance levels further comprises:
retrieving, by the authentication device, a first key share corresponding to the first assurance level and mother key share(s) corresponding to the other token share(s);
deriving, by the authentication device, the token share corresponding to the first assurance level from the first key share; and
deriving, by the authentication device, the other token share(s) corresponding to the lower assurance levels from the other key share(s).

18. The method of claim 14 , wherein the initiator device determines a highest assurance level associated with a threshold amount of token shares received from the plurality of authentication devices that include the authentication device and are proximate the initiator device.

19. The method of claim 14 further comprising:
determining, by the authentication device, the trust score associated with the initiator device based on at least network data,
wherein the network data includes at least one from among transmission rates, data reception rates, average size of data packets, source addresses, domain name system information, IP addresses, hostnames, signal strength data, and Wi-Fi connection data, and
wherein the trust score is determined based on at least one at least one from among a difference between historically typical transmission rates and the transmission rates, a difference between historically typical data reception rates and the data reception rates, and a difference between historically typical average size of data packets and the average size of data packets.

20. The method of claim 19 , wherein the trust score is a local trust score, and wherein determining the trust score further comprises:
receiving, by the authentication device, one or more remote trust scores from one or more additional authentication devices; and
determining, by the authentication device, the trust score using a weighted average of the local trust score and the one or more remote trust scores.

Assignees

• Visa Int Service Ass

Inventors

• Salajegheh Mastooreh
• Agrawal Shashank
• Le Saint Eric
• Mohassel Payman
• Christodorescu Mihai

Classifications

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06F2221/2103

  Challenge-response · CPC title