In-band identity verification and man-in-the-middle defense

Patent metadata

Field	Value
Publication number	US-9906506-B1
Application number	US-201715627855-A
Country	US
Kind code	B1
Filing date	Jun 20, 2017
Priority date	Jun 27, 2014
Publication date	Feb 27, 2018
Grant date	Feb 27, 2018

Abstract

A variety of techniques for performing identity verification are disclosed. As one example, a verification request is received from a remote user. The verification request pertains to a cryptographic key. In response to receiving a confirmation from a local user of the local device, a verification process is initiated. A result of the verification process is transmitted to the remote user. As a second example, a verification request can be received at the local device, from a local user of the device. A verification process with respect to the local user is initiated, and a result of the verification process is transmitted to a remote user that is different from the local user.

First claim

What is claimed is:

1. A method comprising:
capturing, on a first device, a first audiovisual recording of a first user of the first device, wherein the first audiovisual recording includes a first hashed representation of a first public key;
receiving, at the first device, a first verification request from a second user of a second device;
providing, to the second device from the first device, the first audiovisual recording that includes the first hashed representation as part of a response to the first verification request received from the second device; and
receiving, at the first device, a first result of the first verification request from the second device.

2. The method of claim 1 , comprising:
displaying, by the first device, a script for the first audiovisual recording, wherein the script includes at least one dynamic element.

3. The method of claim 1 , comprising:
transmitting, from the first device, a second verification request to the second user of the second device; and
receiving, at the first device, a second audiovisual recording from the second device, wherein the second audiovisual recording includes a second hashed representation of a second public key.

4. The method of claim 3 , comprising:
obtaining, by the first device, the second public key from a first server.

5. The method of claim 4 , comprising:
hashing, by the first device, the second public key obtained from the server to derive a third hashed representation of the second public key.

6. The method of claim 5 , comprising:
comparing, at the first device, the second hashed representation of the second key received from the second device with the derived third hashed representation of the second public key; and
verifying the second user when the second hashed representation matches the third hashed representation.

7. The method of claim 1 , comprising:
receiving, by the first device, encrypted communications from the second device when the result of the first verification request is successful.

8. A system, comprising:
a processor configured to:
capture a first audiovisual recording of a first user of a first device, wherein the first audiovisual recording includes a first hashed representation of a first public key;
receive a first verification request from a second user of a second device;
provide the second device with the first audiovisual recording that includes the first hashed representation as part of a response to the first verification request received from the second device; and
receive a first result of the first verification request from the second device; and

a memory coupled to the processor and configured to provide the processor with instructions for capturing the first audiovisual recording and responding to the first verification request.

9. The system of claim 8 , wherein the processor is configured to:
display a script for the first audiovisual recording, wherein the script includes at least one dynamic element.

10. The system of claim 8 , wherein the processor is configured to:
transmit a second verification request to the second user of the second device; and
receive a second audiovisual recording from the second device, wherein the second audiovisual recording includes a second hashed representation of a second public key.

11. The system of claim 10 , wherein the processor is configured to:
obtain the second public key from a first server; and
hash the second public key obtained from the server to derive a third hashed representation of the second public key.

12. The system of claim 11 , wherein the processor is configured to:
compare the second hashed representation of the second key received from the second device with the derived third hashed representation of the second public key; and
verify the second user when the second hashed representation matches the third hashed representation.

13. The system of claim 12 , wherein the processor is configured to:
transmit encrypted communications to the second device when the second user is verified.

14. A non-transitory computer readable medium comprising instructions, that when executed by a processor, perform the steps of:
capturing a first audiovisual recording of a first user of a first device, wherein the first audiovisual recording includes a first hashed representation of a first public key;
receiving a first verification request from a second user of a second device;
providing the second device with the first audiovisual recording that includes the first hashed representation as part of a response to the first verification request received from the second device; and
receiving a first result of the first verification request from the second device.

15. The non-transitory computer-readable medium of claim 14 , comprising instructions for:
displaying a script for the first audiovisual recording, wherein the script includes at least one dynamic element.

16. The non-transitory computer-readable medium of claim 14 , comprising instructions for:
transmitting a second verification request to the second user of the second device; and
receiving a second audiovisual recording from the second device, wherein the second audiovisual recording includes a second hashed representation of a second public key.

17. The non-transitory computer-readable medium of claim 16 , comprising instructions for:
obtaining the second public key from a first server; and
hashing the second public key obtained from the server to derive a third hashed representation of the second public key.

18. The non-transitory computer-readable medium of claim 17 , comprising instructions for:
comparing the second hashed representation of the second key received from the second device with the derived third hashed representation of the second public key; and
verifying the second user when the second hashed representation matches the third hashed representation.

19. The non-transitory computer-readable medium of claim 14 , comprising instructions for:
exchanging encrypted communications with the second device when the result of the first verification request is successful.

Assignees

• Wickr Inc

Inventors

• Howell Christopher
• Statica Robert
• Coppa Kara Lynn

Classifications

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title