System and method for verifying status of an authentication device

Patent metadata

Field	Value
Publication number	US-9455988-B2
Application number	US-201615095498-A
Country	US
Kind code	B2
Filing date	Apr 11, 2016
Priority date	Feb 22, 2013
Publication date	Sep 27, 2016
Grant date	Sep 27, 2016

Abstract

A system and method that includes receiving a first device profile and associating the first device profile with a first application instance that is assigned as an authentication device of a first account; receiving a second device profile for a second application instance, wherein the second application instance is making a request on behalf of the first account; comparing the second device profile to the first device profile; and completing the request of the second application instance according to results of comparing the second device profile and the first device profile.

First claim

What is claimed is:

1. A method comprising:
receiving a first digital fingerprint and associating the first digital fingerprint with a first application instance, operable on a first electronic device, the first application instance assigned as an authentication factor of a first account, wherein the first digital fingerprint is indicative of characteristics of the first electronic device;
receiving a request from a second application instance, the second application instance operable on a second electronic device; wherein receiving the request comprises receiving a second digital fingerprint associated with the second application instance; wherein the second digital fingerprint is indicative of characteristics of the second electronic device; wherein the request is associated with the first account;
generating a comparison of the first digital fingerprint and the second digital fingerprint; wherein generating the comparison comprises evaluating a match between the first digital fingerprint and the second digital fingerprint; and
processing the request according to the comparison of the first digital fingerprint and the second digital fingerprint.

2. The method of claim 1 ,
wherein evaluating the match results in the match failing to satisfy a match threshold;
wherein processing the request further comprises:
collecting supplemental digital fingerprint information indicative of supplemental characteristics of the second electronic device, the supplemental characteristics distinct from and in addition to the characteristics of the second electronic device;
updating the second digital fingerprint with the supplemental digital fingerprint information, thereby generating an updated second digital fingerprint;
generating a comparison of the updated second digital fingerprint and the first digital fingerprint; and
further processing the request according to the comparison of the updated second digital fingerprint and the first digital fingerprint.

3. The method of claim 2 , further comprising:
receiving additional digital fingerprint information indicative of the characteristics of the first electronic device;
detecting that the additional digital fingerprint information is more up-to-date than at least a subset of information contained within the first digital fingerprint; and
in response to detecting that the additional digital fingerprint information is more up-to-date than at least the subset of information contained within the first digital fingerprint, updating the first digital fingerprint with the additional digital fingerprint information;
wherein generating the comparison of the updated second digital fingerprint and the first digital fingerprint comprises generating a comparison of the updated second digital fingerprint and the additional digital fingerprint information.

4. The method of claim 1 , further comprising:
receiving additional digital fingerprint information indicative of the characteristics of the first electronic device;
detecting that the additional digital fingerprint information is more up-to-date than at least a subset of information contained within the first digital fingerprint; and
in response to detecting that the additional digital fingerprint information is more up-to-date than at least the subset of information contained within the first digital fingerprint, updating the first digital fingerprint with the additional digital fingerprint information;
wherein generating the comparison of the first digital fingerprint and the second digital fingerprint comprises generating a comparison of the second digital fingerprint and the additional digital fingerprint information.

5. The method of claim 1 , further comprising:
collecting second electronic device information at the second application instance, the collecting comprising:
generating a comparison of a first operating system type of the first electronic device and a second operating system type of the second operating system type,
determining one or more types of device profile information to be collected based on the comparison of the first operating system type and the second operating system type; and
collecting the second electronic device information according to the determined types of device profile information; and

generating, at the second application instance, the second digital fingerprint from the second electronic device information.

6. The method of claim 5 , wherein determining the one or more types of device profile information to be collected comprises determining that the one or more types of device profile information include application version numbers in response to the comparison of the first and second operating system types indicating identical operating system types.

7. The method of claim 5 , wherein the first and the second digital fingerprints each comprise intrinsic device information and device usage information, and wherein generating the comparison of the first digital fingerprint and the second digital fingerprint comprises:
assigning a greater weight to the device usage information if the comparison of the first and the second operating system types indicates distinct operating systems, wherein evaluating the match comprises evaluating the match based on the greater weight.

8. The method of claim 1 , further comprising:
assigning the first application instance as an authentication factor of a second account;
receiving a second account request from the second application instance; wherein receiving the second account request comprises receiving a third digital fingerprint of the second application instance;
generating a comparison of the third digital fingerprint and the first digital fingerprint; and
processing the second account request according to the comparison of the third digital fingerprint and the first digital fingerprint.

9. The method of claim 1 , further comprising:
receiving a digital fingerprint match policy, the policy specified by an administrator of a service provider, wherein the first account is an account of the service provider,
wherein evaluating the match between the first digital fingerprint and the second digital fingerprint comprises evaluating the match according to the digital fingerprint match policy.

10. The method of claim 1 , wherein the request is a request to authenticate a user of the first account.

11. The method of 10 , further comprising classifying the first account as a flagged first account requiring increased security, wherein receiving the request and receiving the second digital fingerprint are in response to a login attempt to the flagged first account.

12. The method of claim 10 , wherein receiving the request and receiving the second digital fingerprint are in response to a failed login attempt to the first account.

13. The method of claim 1 , wherein the request is an authentication request, the method further comprising:
receiving a user-submitted username and password for the first account; and
comparing the user-submitted username and password to a stored username and password associated with the first account;
wherein receiving the second digital fingerprint comprises receiving the second digital fingerprint in response to successfully comparing the user-submitted username and password and the stored username and password;
wherein the comparison of the first and the second digital fingerprints is independent of and in addition to comparison of the user-submitted username and password and the stored username and password.

14. The method of claim 13 , wherein evaluating the match results in the match failing to satisfy a match thre

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Song Douglas

Classifications

• G06F21/44 Primary

  Program or device authentication · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• G06F2221/2131

  Lost password, e.g. recovery of lost or forgotten passwords · CPC title