IP Library › Granted Patent US 9,078,129

Granted Patent B1

US 9,078,129 · App. 13/625,418 · Granted Jul 7, 2015

Knowledge-based authentication for restricting access to mobile devices

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 9,078,129
App. No.: 13/625,418
Granted: Jul 7, 2015
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

An improved technique involves authenticating a user requesting access to a particular mobile device using knowledge-based authentication (KBA) questions generated from data taken from a group of mobile devices to which the particular mobile device belongs. Along these lines, consider a corporation that has a group of mobile devices distributed to its employees. The mobile devices provide data to an enterprise KBA (eKBA) server regarding events on each of the mobile devices. Because an owner of a mobile device belongs to a group of employees, the owner is able to answer questions regarding fellow employees. On the other hand, a malicious user that illegitimately gains access to the owner's mobile device will not be able to answer such questions, even if the malicious user knows details about the owner.

Claims (126)

1. A method of authenticating a user operating a particular mobile device, the method comprising:

receiving facts from a group of mobile devices, the group of mobile devices including the particular mobile device, the facts describing events involving the user;

generating, at a knowledge-based authentication (KBA) server, a set of KBA questions from the facts;

receiving a request from the user to access protected resources stored locally in the particular mobile device while the user operates the particular mobile device;

in response to receiving the request, presenting at least one question of the set of KBA questions to the user, the at least one question challenging the user's knowledge of an event described by the facts;

obtaining at least one answer from the user to the at least one question, the at least one answer signifying the user's knowledge of the event described by the facts; and

generating an authentication result from the at least one answer, the user being granted or denied access to the protected resources stored locally in the particular mobile device based on the authentication result;

wherein the events involving the user include a scheduling of a meeting between the user and a coworker;

wherein presenting the at least one question of the set of KBA questions to the user includes sending the user a question concerning an actual time at which the meeting was scheduled;

wherein obtaining the at least one answer from the user to the at least one question includes receiving a selected time at which the user may have scheduled the meeting; and

wherein generating the authentication result includes comparing the selected time to the actual time;

wherein presenting the at least one question of the set of KBA questions to the user further includes sending the user another question concerning an actual identity of the coworker;

wherein obtaining the at least one answer from the user to the at least one question further includes receiving a selected identity of the coworker; and

wherein generating the authentication result further includes comparing the selected identity to the actual identity.

2. The method as in claim 1 , further comprising:

after receiving the facts, storing the facts in a column-oriented, No-SQL database;

wherein generating the set of KBA questions includes:

performing a set of massive multi-processing operations on the facts stored in the column-oriented, No-SQL database; and

wherein presenting the at least one question includes:

sending the at least one question to the particular device over a network.

3. The method as in claim 2 ,

wherein the group of mobile devices is part of an enterprise having a policy;

wherein generating the set of KBA questions includes:

selecting KBA questions of the set of KBA questions based on the policy.

4. The method as in claim 3 ,

wherein the policy includes rules configured to control i) permissions regarding categories of KBA questions allowed to be sent to the user, and ii) a level of difficulty associated with the KBA questions sent to the user, and

wherein presenting the at least one question further includes:

applying the policy to the set of KBA questions to produce the selected questions.

5. The method as in claim 4 ,

wherein the policy further includes additional rules configured to control permissions regarding additional categories of KBA questions allowed to be sent to the user, the additional rules being generated by an electronic computing system remote from the group of mobile devices, and

wherein presenting the at least one question to the user further includes:

receiving information associated with the additional rules via a network interface of the particular mobile device.

6. The method as in claim 2 ,

wherein each mobile device of the group of mobile devices further includes a trigger configured to create events in the mobile device,

wherein the facts stored in the column-oriented, No-SQL database includes event data produced upon an occurrence of a trigger-based event created by the trigger, and

wherein receiving the facts from the group of mobile devices includes:

collecting event data upon the occurrence of the trigger-based event.

7. The method as in claim 6 ,

wherein the trigger includes a global positioning system (GPS) device,

wherein the trigger-based event is location data derived from the GPS device corresponding to a particular location, and

wherein collecting the event data upon the occurrence of the trigger-based event includes:

receiving, as the event data, mobile device location data derived from the GPS device.

8. The method as in claim 7 ,

wherein the trigger includes a gyroscopic device,

wherein the trigger-based event is a speed associated with motion of the mobile apparatus detected by the gyroscope exceeding a threshold speed, and

wherein collecting the event data upon the occurrence of the trigger-based event includes:

receiving, as the event data, mobile device path data derived from the GPS device and the gyroscopic device.

9. The method as in claim 6 ,

wherein the trigger includes a web browser,

wherein the trigger-based event is the web browser accessing a particular website, and

wherein collecting the event data upon the occurrence of the trigger-based event includes:

receiving, as the event data, facts derived from the particular website.

10. The method as in claim 2 ,

wherein receiving the facts from the group of mobile devices includes:

obtaining facts from each mobile device of the group of mobile devices after a specified periodic time interval.

11. A system constructed and arranged to authenticate a user operating a particular mobile device, the system comprising,

a network interface;

memory; and

a controller including controlling circuitry coupled to the memory, the controlling circuitry being constructed and arranged to:

receive facts from a group of mobile devices, the group of mobile devices including the particular mobile device, the facts describing event involving the user;

generate, at a knowledge-based authentication (KBA) server, a set of KBA questions from the facts;

receive a request from the user to access protected resources stored locally in the particular mobile device while the user operates the particular mobile device;

in response to receiving the request, present at least one question of the set of KBA questions to the user, the at least one question challenging the user's knowledge of an event described by the facts;

obtain at least one answer from the user to the at least one question, the at least one answer signifying the user's knowledge of the event described by the facts; and

generate an authentication result from the at least one answer, the user being granted or denied access to the protected resources stored locally in the particular mobile device based on the authentication result;

wherein the events involving the user include a scheduling of a meeting between the user and a coworker;

wherein the controlling circuitry constructed and arranged to present the at least one question of the set of KBA questions to the user is further constructed and arranged to send the user a question concerning an actual time at which the meeting was scheduled;

wherein the controlling circuitry constructed and arranged to obtain the at least one answer from the user to the at least one question is further constructed and arranged to receive a selected time at which the user may have scheduled the meeting; and

wherein the controlling circuitry constructed and arranged to generate the authentication result is further constructed and arranged to compare the selected time to the actual time;

wherein the controlling circuitry constructed and arranged to present the at least one question of the set of KBA questions to the user is further constructed and arranged to sending the user another question concerning an actual identity of the coworker;

wherein the controlling circuitry constructed and arranged to generate the authentication result is further constructed and arranged to compare the selected identity to the actual identity.

12. The system as in claim 11 , wherein the controlling circuitry is further constructed and arranged to:

after receiving the facts, store the facts in a column-oriented, No-SQL database; and

wherein the controlling circuitry constructed and arranged to generate the set of KBA questions is further constructed and arranged to:

perform a set of massive multi-processing operations on the facts stored in the column-oriented, No-SQL database; and

wherein the controlling circuitry constructed and arranged to present the at least one question is further constructed and arranged to:

send the at least one question to the particular device over a network.

13. The system as in claim 12 ,

wherein the group of mobile devices is part of an enterprise having a policy;

wherein the controlling circuitry constructed and arranged to generate the set of KBA questions is further constructed and arranged to:

select KBA questions of the set of KBA questions based on the policy.

14. The system as in claim 13 ,

wherein the controlling circuitry constructed and arranged to present the at least one question is further constructed and arranged to:

apply the policy to the set of KBA questions to produce the selected questions.

15. The system as in claim 14 ,

wherein the controlling circuitry constructed and arranged to present the at least one question to the user is further constructed and arranged to:

receive information associated with the additional rules via a network interface of the particular mobile device.

16. A computer program product having a non-transitory, computer-readable storage medium which stores code to authenticate a user operating a particular mobile device, the code including instructions to:

receive facts from a group of mobile devices, the group of mobile devices including the particular mobile device, the facts describing events involving the user;