Consensus-based online authentication

Patent metadata

Field	Value
Publication number	US-12200113-B2
Application number	US-202217956584-A
Country	US
Kind code	B2
Filing date	Sep 29, 2022
Priority date	Mar 29, 2018
Publication date	Jan 14, 2025
Grant date	Jan 14, 2025

Abstract

Methods and systems for consensus-based online authentication are provided. An encryption device may be authenticated based on an authentication cryptogram generated by the encryption device. The encryption device may transmit a request for security assessment to one or more support devices. The support devices may individually assess the encryption device, other security devices, and contextual information. The support devices may choose to participate in a multi-party computation with the encryption device based on the security assessments. Support devices that choose to participate may transmit one or more secret shares or partial computations to the encryption device. The encryption device may use the secret shares or partial computations to generate an authentication cryptogram. The authentication cryptogram may be transmitted to a decryption device, which may decrypt the authentication cryptogram, evaluate its contents, and authenticate the encryption device based on its contents.

First claim

What is claimed is:

1. A method for participating in a generation of a cryptogram, the method comprising:
receiving, by one or more support devices, a request for security assessment, wherein the request is for the one or more support devices to participate in a multi-party computation to generate the cryptogram, and wherein each of the one or more support devices stores one or more secret shares among a plurality of secret shares generated based on a shared secret;
receiving, by the one or more support devices, security data comprising one or more security properties corresponding to a current state of a device providing the security data;
based on the one or more security properties, determining, by the one or more support devices, whether to participate in the multi-party computation, the determining comprising determining by at least one support device among the one or more support devices to participate; and
based on the at least one support device determining to participate, providing, by the at least one support device, at least one partial cryptographic value to an encryption device, wherein the at least one partial cryptographic value is configured to be used by the encryption device to generate the cryptogram via the multi-party computation, and wherein the at least one partial cryptographic value is generated based on one or more secret shares stored by the at least one support device.

2. The method of claim 1 , wherein the security data include one or more of a group consisting of:
a location of the encryption device, a user authentication risk estimate, whether a user is present at the encryption device, a purpose for generating the cryptogram, a local time at the encryption device, a local time at the device, and an IP address of the encryption device.

3. The method of claim 1 , wherein reference data includes one or more of the following:
one or more previous locations of the encryption device, one or more previous user authentication risk estimate, whether a user was previously present at the encryption device, one or more previous purposes for generating one or more cryptograms, one or more previous times at which the one or more cryptograms were generated, and one or more previous IP addresses of the encryption device.

4. The method of claim 1 , wherein the determining whether to participate in the multi-party computation further comprises:
determining a likelihood that the cryptogram is being generated for a fraudulent purpose;
comparing the likelihood to a predetermined assurance level; and
determining to participate in the multi-party computation in response to the likelihood being less than the predetermined assurance level.

5. The method of claim 1 , further comprising:
transmitting a request for the security data to one or more other support devices; and
receiving the security data from the one or more other support devices.

6. The method of claim 1 , wherein a number of secret shares included in the partial cryptographic value is inversely proportional to a likelihood that the cryptogram is being generated for a fraudulent purpose.

7. The method of claim 1 , wherein the cryptogram comprises one or more of the following: an assurance level and user information.

8. The method of claim 1 , wherein the one or more security properties include identification data used by the one or more support devices to identify a source of the security data, and
wherein the determining whether to participate in the multi-party computation further comprises identifying, using the identification data, the source of the security data to be a peer in a group of devices comprising the one or more support devices.

9. The method of claim 1 , wherein the one or more security properties include one or more signed digital certificates, and
wherein the determining whether to participate in the multi-party computation further comprises authenticating one or more sources of the security data by verifying the signed digital certificates.

10. The method of claim 1 , wherein the determining whether to participate in the multi-party computation further comprises:
determining a likelihood that the cryptogram is being generated for a fraudulent purpose;
comparing the likelihood to a predetermined assurance level; and
determining to participate in the multi-party computation in response to the likelihood being equal to or more than the predetermined assurance level.

11. A method for generating a cryptogram, the method being performed by an encryption device and comprising:
transmitting a request for a security assessment to one or more support devices, wherein the request is for the one or more support devices to participate in a multi-party computation to generate the cryptogram, wherein the one or more support devices store one or more secret shares among a plurality of secret shares generated based on a shared secret;
transmitting security data to the one or more support devices;
receiving at least one partial cryptographic value from at least one support device of the one or more support devices, wherein the at least one partial cryptographic value is generated based on one or more secret shares stored by the at least one support device; and
generating the cryptogram using the at least one partial cryptographic value and a partial cryptographic value of the encryption device.

12. The method of claim 11 , wherein the security data include one or more of the following: location of the encryption device, a user authentication risk estimate, whether a user is present at the encryption device, a purpose for generating the cryptogram, a local time at the encryption device, a local time at the one or more support devices, and an IP address of the encryption device.

13. The method of claim 11 , further comprising transmitting the cryptogram to a decryption device, the decryption device decrypting the cryptogram in order to produce an assurance level, wherein the assurance level is proportional to a likelihood that the cryptogram was generated for a fraudulent purpose.

14. The method of claim 11 , wherein the cryptogram comprises one or more of the following: an encrypted assurance level and encrypted user information.

15. A method of decrypting a cryptogram, the method being performed by a decryption system and comprising:
storing a plurality of secrets on one or more decryption devices of the decryption system, wherein the plurality of secrets are also stored by an encryption system, wherein each of the plurality of secrets is stored by the decryption system in association with a different assurance level, wherein encryption devices of the encryption system contribute more secret shares to generate a first secret for a first assurance level than to generate a second secret for a second assurance level lower than the first assurance level, among the plurality of secrets;
receiving the cryptogram from the encryption system;
selecting a secret corresponding to a particular assurance level, among the plurality of secrets, to decrypt the cryptogram; decrypting the cryptogram using the secret to obtain information; and
processing the information based on a protocol corresponding to the particular assurance level.

16. The method of claim 15 , wherein:
the selecting the secret comprises selecting the first secret;
the decrypting comprises decrypting the cryptogram using the first secret to obtain confidential information; and
the processing comprises processing the confidential information based on a first protocol.

17. The method of claim 16 , further comprising recei

Assignees

• Visa Int Service Ass

Inventors

• Le Saint Eric
• Kumaraswamy Subramanian

Classifications

• H04W12/63

  Location-dependent; Proximity-dependent · CPC title

• H04L2209/46

  Secure multiparty computation, e.g. millionaire problem · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/105

  Multiple levels of security · CPC title