System, device, and method of cross-channel user authentication

Patent metadata

Field	Value
Publication number	US-12225003-B2
Application number	US-202218078962-A
Country	US
Kind code	B2
Filing date	Dec 11, 2022
Priority date	Dec 11, 2022
Publication date	Feb 11, 2025
Grant date	Feb 11, 2025

Abstract

Cross-channel user authentication is provided, to increase resilience of a computerized system to cyber-attacks and to fraudulent transactions. In a demonstrative scenario, a user utilizes his web browser on his laptop computer to log-in to a web server; which in turn extracts the IP address of the laptop computer. The web server triggers an application server to send a Push Notification to a Mobile App that had been installed on a smartphone of that user who just logged in; and that Push Notification causes that smartphone to respond to the application server with the IP address of the smartphone. If the IP address of the computer is not identical to the IP address of the smartphone, then the servers determine that the log-in attempt on the computer was possibly fraudulent, and fraud mitigation operations are initiated. Optionally, geo-location data, device orientation data, device motion data, or other parameters are used as part of the cross-channel authentication process.

First claim

What is claimed is:

1. A method comprising:
(a) receiving user log-in data or user-authentication data, that a user submits or provides to a first server via a web browser operated on a computer that is selected from the group consisting of: a laptop computer, a desktop computer;
(b) determining, at said first server, that said user log-in data or user-authentication data matches credentials that were established for a particular user-account that is served by said first server;
(c) determining, at said first server, an Internet Protocol (IP) address of said computer, by extracting the IP address that said computer advertises to Internet servers;
(d) determining, at said first server, that said particular user-account is associated with a Mobile App that was installed on a smartphone of an account-owner of said particular user-account;
(e) sending, by said first server or by a second server which is an applications server, a Push Notification to said Mobile App that was installed on the smartphone of said account-owner; and triggering the smartphone, via said Push Notification, to respond with a response that includes therein an Internet Protocol (IP) address of said smartphone;
(f) if (I) the IP address of the smartphone, that was obtained in step (e) in response to said Push Notification, is different from (II) the IP address of said computer as determined in step (c) by said first server, then: determining that said computer is possibly utilized by a cyber-attacker, and initiating one or more pre-defined fraud mitigation operations.

2. The method of claim 1 ,
wherein sending the Push Notification to said Mobile App on said smartphone, comprises sending a silent and user-transparent Push Notification (i) that does not cause any pop-up message to appear on said smartphone, and (ii) that does not require a user of said smartphone to respond or react, and (iii) that is invisible to the user of said smartphone.

3. The method of claim 1 ,
wherein the first server is a web server that serves users that access their user-accounts via a web browser;
wherein the second server is an application server that serves users that access their user-accounts via a Mobile App;
wherein the web server triggers the application server to send said Push Notification to said smartphone upon a log-in attempt to said particular user-account.

4. The method of claim 1 , further comprising:
if said Push Notification fails to trigger the smartphone to respond with its IP address, then:
utilizing a previously-obtained IP address, that was obtained in response to a previous Push Notification to said Mobile App on said smartphone, instead of using a freshly-obtained IP address of said smartphone;
wherein step (f) comprises:
if (i) the IP address of said computer as determined by said first server, is not identical to (ii) any IP address of the smartphone that was obtained in the past T hours in response to a Push Notification to the Mobile App on the smartphone, then: determining that said computer is possibly utilized by a cyber-attacker and initiating one or more pre-defined fraud mitigation operations; wherein T is a pre-defined positive number.

5. The method of claim 1 , further comprising:
if the IP address of the smartphone is not identical to the IP address of said computer as determined by said first server, then:
utilizing a previously-obtained IP address, that was obtained in response to a previous Push Notification to said Mobile App on said smartphone, instead of using a freshly-obtained IP address of said smartphone;
wherein step (f) comprises: if (i) the IP address of said computer as determined by said first server, is not identical to (ii) any IP address of the smartphone that was obtained in the past T hours in response to a Push Notification to the Mobile App on the smartphone, then: determining that said computer is possibly utilized by a cyber-attacker and initiating one or more pre-defined fraud mitigation operations; wherein T is a pre-defined positive number.

6. The method of claim 1 , further comprising:
if the IP address of the smartphone is not identical to the IP address of said computer as determined by said first server, then:

(A) determining that the computer is in a Wi-Fi range of a particular Wi-Fi network having a particular Service Set Identifier (SSID);
(B) in response to said Push Notification to said smartphone, determining that the smartphone, even if not connected to said particular Wi-Fi network, is within the Wi-Fi range of said particular Wi-Fi network having said particular SSID;
(C) based cumulatively on the determining of step (A) and the determining of step (B), further determining that said computer is more-probably utilized by a legitimate user and not by an attacker.

7. The method of claim 1 , further comprising:
performing continuous cross-channel user authentication, to continuously authenticate said user that remains logged-in on said computer, by periodically sending Push Notifications to said Mobile App on said smartphone, and periodically checking that IP addresses that were extracted from responses to the Push Notifications match the IP address of said computer.

8. The method of claim 1 , further comprising:
in response to said Push Notification, further obtaining a geo-location of said smartphone;
obtaining a geo-location of said computer, by said first server;
determining if the geo-location of said computer, is distant by at least N kilometers from any geo-location of said smartphone in the past D days, wherein D is a pre-defined positive number, then: determining that said computer is possibly utilized by a cyber-attacker and initiating one or more pre-defined fraud mitigation operations; wherein D is a pre-defined positive number.

9. The method of claim 1 , further comprising:
obtaining from said smartphone, in response to said Push Notification to said Mobile App, device orientation data;
detecting that said first server is accessed via a web browser running on a smartphone, and obtaining by said first server device orientation data of said smartphone using a method that does not rely on any Push Notification to any Mobile App;
if (I) device orientation data of said smartphone, as obtained from said smartphone in response to said Push Notification, is different from (II) device orientation data of said smartphone as obtained from said smartphone using a method that does not rely on any Push Notification to any Mobile App, then: determining that said computer is possibly utilized by a cyber-attacker and initiating one or more pre-defined fraud mitigation operations.

10. The method of claim 1 , further comprising:
obtaining from said smartphone, in response to said Push Notification to said Mobile App, device motion data;
detecting that said first server is accessed via a web browser running on a smartphone, and obtaining by said first server device motion data of said smartphone using a method that does not rely on any Push Notification to any Mobile App;
if (I) device motion data of said smartphone, as obtained from said smartphone in response to said Push Notification, is different from (II) device motion data of said smartphone as obtained from said smartphone using a method that does not rely on any Push Notification to any Mobile App, then: determining that said computer is possibly utilized by a cyber-attacker and initiating one or more pre-defined fraud mitigation operations.

11. The method of claim 1 , further comprising:
in response to said Push Notification, receiving from said smartphone a signal indicating that said smartphone is currently being utilized in a voice call;
determining that the smar

Assignees

• Biocatch Ltd

Inventors

• Novick Itai
• Mazor Gad
• Eidelsztein Iris

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06Q40/02

  Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03) · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title