Granted Patent B1

US 10,075,437 · App. 15/073,743 · Granted Sep 11, 2018

Inventors: Neil Costigan (Lulea, SE); Ingo Deutschmann (Merseburg, DE); Tony Libell (Lulea, SE); Johanna Skarpman Munter (Lulea, SE); Peder Nordström (Lulea, SE)

Assignee: BEHAVIOSEC

H04L63/0861G06F21/316G06F21/32G06F21/34H04L9/14H04L9/30H04L9/3231H04L9/3242H04L9/3271H04L63/06H04L63/08H04L63/0853H04L67/42

Abstract

Claims (47)

1. A computer-implemented method for secure authentication of a user to a service for executing a transaction, the method being implemented in a system including:

a user device operated by the user, the user device including a FIDO (Fast IDentity Online)-client using a FIDO interface for encrypted communication of FIDO UAF (Universal Authentical Framework) messages, and a user-agent;

a FIDO-server of a relying party providing the service;

a behaviometric server in communication with the user-agent of the user device and with the FIDO-server using a FIDO-identifier; and

a web server associated with the relying party, the web server being in communication with the FIDO server, the FIDO client, and the behaviometric server,

the method comprising:

a. in a preparation stage

i. upon user initiation of a session by establishing a TLS-connection between the user device and the web-server, generating a unique session ID;

ii. using a background process running during said session and using said session ID, collecting behavioral input data from at least one user input component of the user device, and storing said behavioral input data in a non-transitory storage medium housed within the user device;

iii. transmitting, from the user agent to the behaviometric server, via said TLS-connection and the web server, a transaction initiation message including the FIDO-identifier and at least a portion of said behavioral input data stored in said non-transitory storage medium; and

b. in an authentication stage:

i. at the behaviometric server comparing said received FIDO-identifier and said received portion of said behavioral input data to a second FIDO-identifier and a second set of behavioral input data collected during prior us of the service by the user;

ii. at the behaviometric server, determining whether said received FIDO identifier matches said second FIDO identifier and whether said portion of said behavioral input data matches said second set of behavioral input data, whereby a match results in an authentication, and a lack of a match results in a rejection of privileged access sought by the user;

iii. if said determining results in said match:

1. transmitting said transaction initiation message from the behaviometric server to the FIDO-server;

2. at the FIDO-server, generating an authentication request including the FIDO-identifier, a transaction message, and a related hash of said transaction message, and transmitting said authentication request to the FIDO-client;

3. at the FIDO client, prompting the user to sign the hash of said transaction message using a private key of an asymmetric key-pair associated with the user;

4. at the FIDO client, in response to the user providing said signed hash of said transaction message, generating an authentication response including said signed hash;

5. transmitting said authentication response from the FIDO client to the FIDO server;

6. at the FIDO server, validating said signed hash of said transaction message included in said authentication response using a public key of said asymmetric key pair associated with the user; and

7. upon validation of said signed hash of said transaction message, executing the transaction of the service.

2. The method of claim 1 , wherein the FIDO-client comprises said FIDO-UAF-client and the FIDO-server comprises a FIDO-UAF-server.

3. The method of claim 1 , wherein the behaviometric-server includes a decryption server therein, and the user-agent sends encrypted data encrypted to the decryption-server for decryption thereby.

4. The method of claim 1 , further comprising:

prior to step b(iii)(2), sending said transaction message, signed or encrypted by at least one of MAC and a behaviometric-server-certificate, from the behaviometric server to the FIDO-server for generation of said authentification request; and

subsequent to step b(iii)(2), at the FIDO-client, decrypting said transaction message and validating at least one of said MAC and a signature of said behaviometric-server using a symmetric key included with said transaction message or validating said signature of the behaviometric-server using at least one of a public key of the behaviometric-server and a certificate of the behaviometric-server.

5. The method of claim 4 , wherein said validating said MAC using said symmetric key comprises validating said MAC using a symmetric key which was at least one of:

generated by a Public Key Infrastructure (PKI); and

exchanged to the user device via a Diffie-Hellman key exchange, an elliptic curve Diffie-Hellman exchange, or an ephemeral elliptic curve Diffie-Hellman exchange.

6. The method of claim 1 , further comprising, sending to the user device, from the web server, an input form requiring the user to enter a text, thereby to facilitate capture of additional behavior data relating to the user.

7. The method of claim 1 , wherein said prompting the user at step b(iii)(3) further comprises requesting that the user enter a PIN related to the user for the service.

8. The method of claim 1 , wherein said transmitting at step a(iii) includes transmitting transactional data from the user agent to the behaviometric server, together with transmission of said transaction initiation message.

9. The method of claim 1 , wherein the behaviometric-server is functionally associated with a profile database containing behavioral input data relating to users.

10. The method of claim 9 , further comprising:

creating a unique FIDO-identifier-profile associated with said FIDO identifier and storing said unique FIDO-identifier-profile in said profile database by said behaviometric-server; and

adding behavioral input data, collected during a registration-session of a new FIDO-identifier for access to the service sought by the user, to the FIDO-identifier-profile in the profile database, said adding behavioral input data includes

creating said asymmetric key-pair associated with the user, an attestation private key of the user at the user device, and an attestation using an attestation public key of the user's public key;

transmitting said attestation public key of the user's public key from the FIDO-client to the FIDO-server, and storing said attestation public key at a cryptographic authentication key reference database at the relying party;

at the FIDO-server, creating a registration request to perform a connection-oriented communication between the FIDO-client and the FIDO-server for the duration of the transaction for which privileged access is sought by the user for and received by the FIDO-client,

wherein said new FIDO identifier is related to said added behavioral input data.

11. The method of claim 10 , wherein said steps of creating a unique FIDO-identifier-profile and of adding behavioral input data during said registration-session are carried out only if new personal data of the user is available.

12. The method of claim 1 , wherein said transmitting at step a(iii) includes transmitting said transaction initiation message via said TLS-connection, said transaction initiation message including said FIDO-identifier, transactional information, and at least a portion of said stored behavioral input data.

13. The method of claim 1 , wherein at least one of:

the behaviometric-server and the FIDO-server share at least one of a processor and a hardware component; and

the behaviometric server is disposed within protected area of the relying party.

14. The method of claim 1 , wherein the behaviometric-server and the FIDO-server are distinct servers, wherein the behaviometric server is not disposed within a protected area of the relying party, and wherein the behaviometric server is disposed on a cloud based on the Internet.

15. The method of claim 1 , wherein said collecting behavioral input data at step a(ii) comprises collecting at least one electronic input observation derived from interaction of the user with said at least one user input component, said at least one electronic input observation being selected from the group consisting of a keystroke pattern, a keystroke style, keystroke dwell time, keystroke flight time, user touch values, user pressure values, and use of one or more particular applications.

Assignments (3)

Continuity (2)

Cited By (89)

US 12,190,330 US 12,200,135 US 12,204,564 US 12,205,103 US 12,216,794 US 12,225,111 US 12,236,423 US 12,238,101 US 12,238,139 US 12,248,832 US 12,248,928 US 12,250,228 US 12,259,882 US 12,260,393 US 12,261,960 US 12,265,896 US 12,277,232 US 12,278,901 US 12,288,205 US 12,288,233 US 12,289,396 US 12,299,065 US 12,299,672 US 12,301,735 US 12,307,457 US 12,333,531 US 12,335,256 US 12,335,412 US 12,341,897 US 12,353,405 US 12,354,077 US 12,354,096 US 12,354,104 US 12,361,424 US 12,368,756 US 12,374,181 US 12,380,456 US 12,381,915 US 12,388,650 US 12,393,926 US 12,412,140 US 12,489,625 US 12,493,869 US 12,494,915 US 12,495,042 US 12,499,432 US 12,505,448 US 12,505,450 US 12,511,638 US 12,511,640 US 12,511,654 US 12,519,652 US 12,526,149 US 12,530,937 US 12,531,748 US 12,532,170 US 12,536,329 US 12,537,804 US 12,556,526 US 12,574,243 US 12,579,532 US 12,580,752 US 12,580,767 US 12,591,828 US 12,591,875 US 12,591,876 US 12,591,885 US 12,592,819 US 12,592,828 US 12,596,780 US 12,609,938 US 12,621,642 US 12,639,710 US 12,641,108 US 12,646,062 US 12,646,370 US 12,657,572 US 12,658,976 US 12,675,766 US 12,675,790 US 12,676,938 US 12,683,796 US 12,688,324 US 12,688,508 US 12,694,044 US 12,694,393 US 12,701,116 US 12,705,324 US 12,718,167