Device identification based on deep fingerprint inspection

Patent metadata

Field	Value
Publication number	US-2016155128-A1
Application number	US-201414557885-A
Country	US
Kind code	A1
Filing date	Dec 2, 2014
Priority date	Dec 2, 2014
Publication date	Jun 2, 2016
Grant date	—

Abstract

A method of identifying a device includes receiving a device transaction request from a remote device, receiving a first device fingerprint of the remote device, and receiving a second device fingerprint of a known device. The first device fingerprint is compared with the second device fingerprint and a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint is generated. A third device fingerprint corresponding to an expected current value of the second device fingerprint is generated, and the first device fingerprint is compared with the third device fingerprint to generate a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint. A response to the transaction request is formulated based on the first metric and the second metric.

First claim

What is claimed is:

1 . A method of identifying a device, comprising:
receiving, at a transaction server, a device transaction request from a remote device; receiving a first device fingerprint of the remote device; receiving a second device fingerprint of a known device; comparing the first device fingerprint with the second device fingerprint and responsively generating a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint; generating a third device fingerprint, the third device fingerprint comprising an expected current value of the second device fingerprint; comparing the first device fingerprint with the third device fingerprint and responsively generating a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint; and generating a response to the transaction request based on the first metric and the second metric.

2 . The method of claim 1 , wherein the known device comprises a known good device, and wherein the response to the transaction request comprises authorizing the transaction based on the second metric.

3 . The method of claim 1 , wherein the known device comprises a known fraud device, and wherein the response to the transaction request comprises rejecting the transaction based on the second metric.

4 . The method of claim 1 , wherein the response to the transaction request comprises requesting additional authentication data from the remote device in response to the first and second metrics indicating that the first device fingerprint does not match the second or third device fingerprints.

5 . The method of claim 1 , wherein the second device fingerprint comprises an operating system version level, and wherein generating the third device fingerprint comprises:
determining that a more recent version level of the operating system is available; updating the operating system version level to the more recent version level; and storing the updated operating system version level in the third device fingerprint.

6 . The method of claim 1 , wherein the second device fingerprint comprises an application software version level, and wherein generating the third device fingerprint comprises:
updating the application software version level to a recent software version level and storing the application software version level in the third device fingerprint.

7 . The method of claim 6 , wherein updating the application software version level comprises:
retrieving an update history associated with the second device fingerprint; and updating the application software version level based on the update history associated with the second device fingerprint.

8 . The method of claim 1 , further comprising:
analyzing an internal consistency of the first device fingerprint; and generating a third metric indicative of the internal consistency of the first device fingerprint.

9 . The method of claim 8 , wherein analyzing the internal consistency of the first device fingerprint comprises:
receiving hardware and software version information associated with the first device; and comparing the hardware and software version information to determine if they are compatible.

10 . The method of claim 8 , wherein analyzing the internal consistency of the first device fingerprint comprises:
receiving hardware version information associated with the first device; determining a clock speed of the first device; and determining if the clock speed of the first device is consistent with the hardware version information associated with the first device.

11 . The method of claim 8 , wherein analyzing the internal consistency of the first device fingerprint comprises:
receiving a reported time zone associated with the first device; receiving geolocation information for the first device; and determining if the reported time zone information of the first device is consistent with the geolocation information for the first device.

12 . The method of claim 8 , wherein analyzing the internal consistency of the first device fingerprint comprises:
receiving network information associated with the first device; and comparing the network information to determine if the network information associated with the device is compatible with the device.

13 . A method of identifying a device, comprising:
receiving a device transaction request from a remote device; receiving a first device fingerprint of the remote device; determining if the first device fingerprint matches any of a first plurality of device fingerprints of known good devices; if the first device fingerprint does not match any of the plurality of device fingerprints of known good devices, determining if the first device fingerprint matches any of a second plurality of device fingerprints of known fraud devices or if the first device fingerprint matches an expected modification of any of the second plurality of device fingerprints of known fraud devices; and if the first device fingerprint matches any of the second plurality of device fingerprints or an expected modification of any of the second plurality of device fingerprints, rejecting the transaction or requiring additional verification before proceeding with the transaction.

14 . The method of claim 13 , further comprising:
if the first device fingerprint matches one of the first plurality of device fingerprints, determining if the first device fingerprint matches an expected modification of the one of the first plurality of device fingerprints; if the first device fingerprint does not match the expected modification of the one of the first plurality of device fingerprints, rejecting the transaction or requiring additional verification before proceeding with the transaction; and if the first device fingerprint matches an expected modification of the one of the first plurality of device fingerprints, authorizing the transaction.

15 . The method of claim 13 , further comprising:
if the first device fingerprint does not match any of the second plurality of device fingerprints and does not match an expected modification of any of the second plurality of device fingerprints, determining of the first device fingerprint is a plausible device fingerprint; and if the first device fingerprint is a plausible device fingerprint, authorizing the transaction.

16 . The method of claim 15 , further comprising, if the first device fingerprint is not a plausible device fingerprint, rejecting the transaction or requiring additional verification before proceeding with the transaction.

17 . A transaction server comprising:
a processing unit; and a memory comprising a fingerprint analysis module; wherein the transaction server receives a device transaction request from a remote device, receives a first device fingerprint of the remote device, and receives a second device fingerprint of a known device; and wherein the fingerprint analysis module comprises computer program instructions that compare the first device fingerprint with the second device fingerprint and responsively generate a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint, generate a third device fingerprint, the third device fingerprint comprising an expected current value of the second device fingerprint, compare the first device fingerprint with the third device fingerprint and responsively generate a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint; and wher

Assignees

• Ca Inc

Inventors

• Desai Suril
• Narayanan Swaminathan
• Rai Akash

Classifications

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• G06Q20/3227

  using secure elements embedded in M-devices · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06Q20/3226 Primary

  Use of secure elements separate from M-devices · CPC title

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title