Method and apparatus to provide continuous authentication based on dynamic personal information

Patent metadata

Field	Value
Publication number	US-9342677-B2
Application number	US-201013814012-A
Country	US
Kind code	B2
Filing date	Aug 4, 2010
Priority date	Aug 4, 2010
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

An authentication method, system and device are provided to continuously collect dynamic personal identification data (DPID) samples through a user device by using one or more sensors to continuously collect biometric and location data samples associated with the user and then securely transfer the DPID samples to a central authentication server where attributes of the DPID samples may be captured and incorporated as part of a challenge-response pair which requests an arbitrarily generated N-tuple of the DPID samples from a predetermined time interval from the user device that is unique to the user and dynamic based on the sensed data and the time-interval of collection.

First claim

What is claimed is:

1. A method of authenticating a user via a handheld electronic device, comprising:
storing at the handheld electronic device a first plurality of dynamic personal identification data samples specific to the user that are collected over time, wherein the first plurality of dynamic personal identification data samples comprises a plurality of biometric data samples associated with the user and a corresponding plurality of location data samples associated with the handheld electronic device;
sending a copy of the first plurality of dynamic personal identification data samples to a remote computing device to be stored as a second plurality of dynamic personal identification samples;
receiving at the handheld electronic device an authentication challenge that is based on the second plurality of dynamic personal identification samples and based on how many dynamic personal identification data samples are saved on the handheld electronic device; and
computing at the handheld electronic device a first authentication response to the authentication challenge based on the plurality of biometric data samples and the plurality of location data samples.

2. The method of claim 1 , further comprising collecting at least a subset of the first plurality of dynamic personal identification data samples from at least a first sensor located proximate to the user.

3. The method of claim 1 , where storing the first plurality of dynamic personal identification data samples comprises storing over time the plurality of biometric data samples associated with the user.

4. The method of claim 3 , wherein the first plurality of dynamic personal identification data samples comprises time information associated with the plurality of biometric data samples.

5. The method of claim 1 , further comprising receiving either a first indication of authorization or second indication of non-authorization based on a comparison of the authentication challenge and the first authentication response.

6. The method of claim 1 , where receiving an authentication challenge comprises receiving a request for an N-tuple that is computed by a remote authentication server based on at least a subset of the second plurality of dynamic personal identification samples.

7. The method of claim 1 , where computing the first authentication response comprises computing an N-tuple based on at least a subset of the first plurality of dynamic personal identification samples to authenticate the user in response to the first authentication response corresponding to the authentication challenge.

8. The method of claim 1 , further comprising sending the first authentication response to a remote authentication server to compare with a second authentication response computed at the remote authentication server in response to the authentication challenge based on at least a subset of the second plurality of dynamic personal identification samples to authenticate the user in response to the second authentication response matching the first authentication response.

9. The method of claim 1 , where receiving the authentication challenge comprises receiving a different authentication challenge each time the user requests authentication.

10. The method of claim 1 , further comprising:
computing at the handheld electronic device a second authentication challenge based on at least a subset of the first plurality of dynamic personal identification samples;
sending the second authentication challenge to the remote computing device to compute a second authentication response based on at least a subset of the second plurality of dynamic personal identification samples; and
receiving at the handheld electronic device the second authentication response to authenticate the remote computing device when the second authentication response corresponds to the second authentication challenge.

11. The method of claim 1 , where the storing at the handheld electronic device the first plurality of dynamic personal identification data samples comprises storing the first plurality of dynamic personal identification data samples on a server computer that is securely connected to the handheld electronic device.

12. The method of claim 6 , where the N-tuple that is computed by the remote authentication server includes at least one of a randomly generated length, and a randomly generated sequence.

13. The method of claim 1 , where computing the first authentication response comprises:
generating a first N-tuple having a first length and sequence from at least a subset of a first plurality of biometric data samples associated with the user; and
generating a second N-tuple having a second length and sequence from at least a subset of a first plurality of location data samples associated with the handheld electronic device, where the first N-tuple and second N-tuple are each generated in response to the authentication challenge.

14. An authentication system, comprising:
a first computing device configured to request data access by:
storing a first plurality of dynamic personal identification data samples specific to an individual, wherein the first plurality of dynamic personal identification samples comprises a plurality of biometric data samples associated with a user and a corresponding plurality of location data samples associated with the first computing device, and
generating a first challenge response in response to a first challenge question, wherein the first challenge response is based on the plurality of biometric data samples and the plurality of location data samples; and

a second computing device configured to authenticate a data access request from the first computing device by:
storing a copy of the first plurality of dynamic personal identification data samples,
formulating a first challenge question based on the copy of the first plurality of dynamic personal identification samples and based on how many dynamic personal identification samples are on the first computing device, and
authenticating the data access request based on a comparison of the first challenge response to the first challenge question.

15. The authentication system of claim 14 , where the first computing device is configured to generate the first challenge response by:
generating a first N-tuple having a first length and sequence; and
generating a second N-tuple having a second length and sequence, where the first N-tuple and the second N-tuple are each generated in response to the first challenge question received from the second computing device.

16. The authentication system of claim 14 , further comprising one or more sensors located proximate to the individual to collect the plurality of biometric data samples associated with the individual and to transmit the plurality of biometric data samples to the first computing device to store as at least part of the first plurality of dynamic personal identification data samples.

17. The authentication system of claim 14 , where the first computing device is further configured to collect time information associated with the plurality of biometric data samples.

18. The authentication system of claim 14 , where the second computing device is configured to formulate a different challenge question each time the first computing device requests data access.

19. The authentication system of claim 14 , where the first computing device is configured to authenticate the second computing device by:
formulating a second challenge question based on the first plurality of dynamic personal

Assignees

• Ali Shirook M
• Labrador Christopher
• Warden James
• Wilson Kelce S
• Blackberry Ltd

Inventors

• Ali Shirook M
• Labrador Christopher
• Warden James
• Wilson Kelce S

Classifications

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• G06F21/31

  User authentication · CPC title

• G06F21/10

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title