Method and system for providing behavioral bi-directional authentication

Patent metadata

Field	Value
Publication number	US-9251327-B2
Application number	US-201113223981-A
Country	US
Kind code	B2
Filing date	Sep 1, 2011
Priority date	Sep 1, 2011
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

An approach for authenticating parties engaged in a web-based transaction without compromising the integrity or anonymity of the parties is described. An authentication platform receives, from a first application associated with a first party, an authentication request that has been redirected in response to a transaction initiated with a second application associated with a second party. The authentication platform forwards knowledge based assessment information to the first application that is based on determined behavioral information for authenticating the second party to the first party. A valid response to the knowledge based assessment information by the first application provides authentication of the first party to the second party.

First claim

What is claimed is:

1. A method comprising:
receiving, from a first application associated with a first party, an authentication request that has been redirected in response to a transaction initiated with a second application associated with a second party;
determining, by a processor device of a third party, behavioral information associated with the first party and the second party;
forwarding, to the first application and the second application, knowledge based assessment information, that is based on the behavioral information, for authenticating the second party and the first party to each other;
receiving from the first application a first response made by the second party to the knowledge based assessment information, and authenticating the second party to the first party by matching the first response with context data detected by one or more sensors of a device of the second party, wherein the context data includes real time geo-location data of the second party; and
receiving from the second application a second response made by the first party to the knowledge based assessment information, and authenticating the first party to the second party by matching the second response with behavioral dynamics of the first party and the second party,
wherein the behavioral dynamics include behavioral patterns of the first and second parties collaborating over a network, and
wherein at least one of the first party and the second party is at least partially authenticated via the matched first response, the matched second response, or a combination thereof.

2. A method according to claim 1 , further comprising:
receiving an identification score and/or a risk score from a risk engine; and
including the identification score and/or the risk score, in the knowledge based assessment information for the first party and the second party to authenticate each other thereby sending the first and second responses to the processor device,
wherein the context data detected at the device of the first party, at the device of the second party, or a combination thereof, includes environmental data associated with the device of the first party, the device of the second party, or a combination thereof, and
wherein the behavioral dynamics include call log information of the first party and the second party.

3. A method according to claim 2 , further comprising:
determining to transmit the behavioral information associated with the first party and the second party to the risk engine configured to execute pattern matching and predictive analytics to determine the identification score and/or the risk score,
wherein when the first and second parties are authenticated to each other, the transaction is permitted while the first and second parties remain anonymous to each other.

4. A method according to claim 1 , wherein the first application is a browser application configured to generate the authentication request, and the transaction involves requesting a web page from the second application, the method further comprising:
redirecting an authentication assertion message through the browser application to the second application.

5. A method according to claim 1 ,
wherein the behavioral patterns are characterized by behavioral characteristics of client/server collaboration schemes, autonomic systems, web-based response systems, or a combination thereof, associated with the collaborating over the network.

6. A method according to claim 2 , wherein when the first or second response to the knowledge based assessment information is not matched with the respective context data, the transaction is denied while the first and second parties remain anonymous to each other, and
wherein the context data detected at the device of the first party, at the device of the second party, or a combination thereof, is detected and matched in real time.

7. A method according to claim 1 ,
wherein the first party and the second party are mutually authenticated via the matched first response and the matched second response.

8. An apparatus comprising:
at least one processor device; and
at least one memory device including computer program code for one or more programs,
the at least one memory device and the computer program code configured to, with the at least one processor device, cause the apparatus to perform at least the following,
receive, from a first application associated with a first party, an authentication request that has been redirected in response to a transaction initiated with a second application associated with a second party,
determine behavioral information associated with the first party and the second party,
forward, to the first application and the second application, knowledge based assessment information, that is based on the behavioral information, for authenticating the second party and the first party to each other,
receive from the first application a first response made by the second party to the knowledge based assessment information, and authenticating the second party to the first party by matching the first response with context data detected by one or more sensors of a device of the second party, wherein the context data includes real time geo-location data of the second party, and
receive from the second application a second response made by the first party to the knowledge based assessment information, and authenticating the first party to the second party by matching the second response with behavioral dynamics of the first party and the second party,
wherein the behavioral dynamics include behavioral patterns of the first and second parties collaborating over a network,
wherein the apparatus is associated with a third party, and
wherein at least one of the first party and the second party is at least partially authenticated via the matched first response, the matched second response, or a combination thereof.

9. An apparatus according to claim 8 , wherein the apparatus is further caused to:
receive an identification score and/or a risk score from a risk engine, and
wherein the one or more identification score and/or the risk score is included in the knowledge based assessment information for the first party and the second party to authenticate each other, thereby sending the first and second responses to the processor device.

10. An apparatus according to claim 9 , wherein the apparatus is further caused to:
determine to transmit the behavioral information associated with the first party and the second party to a risk engine configured to execute pattern matching and predictive analytics to determine the identification score and/or the risk score,
wherein when the first and second parties are authenticated to each other, the transaction is permitted while the first and second parties remain anonymous to each other.

11. An apparatus according to claim 8 , wherein the first application is a browser application configured to generate the authentication request, and the transaction involves requesting a web page from the second application, the apparatus being further caused to:
redirect an authentication assertion message through the browser application to the second application.

12. An apparatus according to claim 8 , wherein the behavioral information associated with the first party and the second party relates to a network address or geolocation of the first party, call log information for authenticating the first party, or a combination thereof, and
wherein the knowledge based assessment information includes behaviors of the first and second parties collaborating over a network.

13. An apparatus according to claim 8 , whe

Assignees

• Donfried Paul A
• Archer Steven T
• Tallent Guy S
• Evans Ashley
• Verizon Patent & Licensing Inc

Inventors

• Donfried Paul A
• Archer Steven T
• Tallent Guy S
• Evans Ashley

Classifications

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title