Continuous authentication confidence module

Patent metadata

Field	Value
Publication number	US-9871779-B2
Application number	US-201514838731-A
Country	US
Kind code	B2
Filing date	Aug 28, 2015
Priority date	Mar 15, 2013
Publication date	Jan 16, 2018
Grant date	Jan 16, 2018

Abstract

Generally, this disclosure describes a continuous authentication confidence module. A system may include user device including processor circuitry configured to determine presence data; a confidence factor including at least one of a sensor configured to capture sensor input and a system monitoring module configured to monitor activity of the user device; memory configured to store a confidence score and an operating system; and a continuous authentication confidence module configured to determine the confidence score in response to an initial authentication of a specific user, update the confidence score based, at least in part, an expectation of user presence and/or selected presence data, and notify the operating system that the authentication is no longer valid if the updated confidence score is within a tolerance of a session close threshold; the initial authentication configured to open a session, the confidence score configured to indicate a current strength of authentication during the session.

First claim

What is claimed is:

1. A system comprising:
processor circuitry to operate in a trusted execution environment (TEE);
sensor circuitry comprising at least one sensor to capture sensor input and a system monitoring module to monitor operation of the system and to collect monitor data related to the monitoring;
communication circuitry to communicate with a remote communication partner; and
a continuous authentication confidence module (CACM) to execute in the TEE and to:
determine a confidence score in response to an initial authentication of a specific user, the confidence score to indicate a current strength of authentication at a point in time during a session;
select a type of presence data for use to update the confidence score based, at least in part, on a level of the confidence score, wherein the CACM is to select a first presence data to update the confidence score when the confidence score is less than a first threshold and select a second presence data to update the confidence score when the confidence score is greater than the first threshold, wherein the first presence data acquisition is to consume more power than the second presence data acquisition;
update the confidence score based, at least in part, on at least one of an expectation of user presence and the selected type of presence data; and
notify the remote communication partner that the authentication is no longer valid if the updated confidence score is within a tolerance of a session close threshold.

2. The system of claim 1 , wherein when the confidence score is at or above a confidence score power threshold, the CACM is to select the type of presence data based at least in part on a power consumption associated with acquisition of the selected type of presence data.

3. The system of claim 1 , wherein the CACM is to:
determine a confidence value based, at least in part, on the selected type of presence data; and
adjust the confidence score based, at least in part, on the confidence value.

4. The system of claim 1 , wherein the selected type of presence data comprises at least one of human presence data to indicate whether an unidentified human is present and user presence data to indicate whether the specific user is present.

5. The system of claim 1 , wherein the CACM is further to determine the confidence score based, at least in part, on a time since authentication.

6. The system of claim 1 , wherein when the confidence score is below an active factor threshold, the CACM is to select the type of presence data based, at least in part, on user presence data associated with an active factor.

7. The system of claim 1 , wherein the CACM is to decay the confidence score over a time duration.

8. The system of claim 1 , wherein the system comprises a portable device.

9. The system of claim 1 , wherein the processor circuitry comprises a converged security engine to execute in the TEE.

10. The system of claim 1 , wherein the system is to attest to the remote communication partner when the session is established.

11. A method comprising:
determining, in a trusted execution environment (TEE) of a computing device, a confidence score in response to an initial authentication of a specific user to the computing device, the confidence score to indicate a current strength of authentication at a point in time during a session established between the computing device and a remote communication partner;
selecting, in the TEE, a type of presence data for use to update the confidence score based, at least in part, on a level of the confidence score and when the confidence score is at or above a confidence score power threshold, selecting the type of presence data based at least in part on a power consumption associated with acquisition of the selected type of presence data;
updating, in the TEE, the confidence score based, at least in part, on at least one of an expectation of user presence and the selected type of presence data; and
notifying the remote communication partner that the authentication is no longer valid if the updated confidence score is within a tolerance of a session close threshold.

12. The method of claim 11 , further comprising selecting a first presence data to update the confidence score when the confidence score is less than a first threshold and selecting a second presence data to update the confidence score when the confidence score is greater than the first threshold, wherein the first presence data acquisition is to consume more power than the second presence data acquisition.

13. The method of claim 11 , wherein the selected type of presence data comprises at least one of human presence data to indicate whether an unidentified human is present and user presence data to indicate whether the specific user is present.

14. The method of claim 11 , wherein when the confidence score is below an active factor threshold, updating the confidence score comprises selecting the type of presence data based at least in part on user presence data associated with an active factor.

15. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
determine, in a trusted execution environment (TEE) of the system, a confidence score in response to an initial authentication of a specific user to the system, the confidence score to indicate a current strength of authentication at a point in time during a session established between the system and a remote communication partner;
select, in the TEE, a type of presence data for use to update the confidence score based, at least in part, on a level of the confidence score and when the confidence score is at or above a confidence score power threshold, select the type of presence data based at least in part on a power consumption associated with acquisition of the selected type of presence data;
update, in the TEE, the confidence score based, at least in part, on at least one of an expectation of user presence and the selected type of presence data; and
notify the remote communication partner that the authentication is no longer valid if the updated confidence score is within a tolerance of a session close threshold.

16. The at least one non-transitory computer readable medium of claim 15 , further comprising instructions that when executed enable the system to select a first presence data to update the confidence score when the confidence score is less than a first threshold.

17. The at least one non-transitory computer readable medium of claim 16 , further comprising instructions that when executed enable the system to select a second presence data to update the confidence score when the confidence score is greater than the first threshold, wherein the first presence data acquisition is to consume more power than the second presence data acquisition.

Assignees

• Intel Corp

Inventors

• Sheller Micah J
• Cahill Conor P
• Martin Jason
• Smith Ned M
• Baker Brandon

Classifications

• G06F2221/2103

  Challenge-response · CPC title

• G06F21/31

  User authentication · CPC title

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• H04L67/24

  Electricity · mapped topic