Online authentication and security management using device-based identification
Techniques are disclosed to provide enhanced online security. When user authenticating information is provided to access secure content, a network server identifies the user via a website identifier. Some of the disclosed techniques leverage third party “cookie stitchers” to associate user data, which may include a website identifier, to the user's computing devices. If the cookie stitcher cannot identify a current computing device, or if a current website identifier does not match one stored in the user data, then 2-factor authentication (2FA) may be triggered. Other disclosed techniques leverage stored device management data (DMD), which uniquely identifies each computing device that is associated with a website identifier. These techniques allow the network server to block access to explicitly-identified computing devices, and to trigger 2FA unless specific computing device metrics, which are associated with a computing device, are matched to computing device metrics contained in the DMD.
1. A computer-implemented method in a network server hosting a website, the method comprising:
actively monitoring, by the network server hosting the website, web traffic between the network server and a computing device of a user currently navigating the website, wherein the web traffic is generated from the computing device visiting the website, including:
determining when a unique computing identifier is present on the computing device, and
correlating, by the network server, the computing device currently navigating the website to a user record corresponding to the user and a unique website identifier of the website;
receiving, by the network server from the computing device, device management data corresponding to user authenticating information that is provided via the computing device attempting to access content that is hosted by the network server, the device management data including (i) one or more device metrics corresponding to one or more the computing devices that previously accessed secure content, and (ii) an indication of whether the computing device is authorized to access the secure content;
when the computing device is authorized to currently access the secure content:
granting, by the network server, the computing device access to the secure content in accordance with a first security protocol that includes a first set of security verifications; and
when the computing device included in the device management data is unauthorized to currently access the secure content:
granting, by the network server, the computing device access to the secure content in accordance with a second security protocol that includes a second set of security verifications;
wherein the first set of security verifications and the second set of security verifications verify a match between (i) one or more of the device metrics and the unique website identifier that correspond to the user record, and (ii) one or more device metrics that were stored in the computing device as a result of previously accessing the secure content and a website identifier generated by the network server, and
wherein a failure of any of the second set of security verifications triggers (i) execution of two-factor authentication (2FA) to grant the computing device access to the secure content upon satisfaction of one or more conditions associated with the 2FA, generation of a new unique computing identifier and transmission of the new unique computing identifier to the computing device or (ii) blocking access to the secure content.
2. The computer-implemented method of claim 1 , wherein the one or more device metrics contained in the device management data include, for the computing device that has previously accessed the secure content, a respective unique computing device identifier, and
wherein one of the second set of security verifications that is implemented in accordance with the second security protocol includes triggering execution of 2FA when a unique computing device identifier is not stored on the computing device.
3. The computer-implemented method of claim 1 , wherein the one or more device metrics contained in the device management data include, for the computing device that has previously accessed the secure content, a respective unique computing device identifier, and
wherein one of the second set of security verifications that is implemented in accordance with the second security protocol includes blocking access of the computing device to the secure content when a unique computing device identifier stored on the computing device matches a respective unique computing device identifier included as part of the device management data indicating that the computing device is unauthorized to currently access the secure content.
4. The computer-implemented method of claim 1 , wherein the one or more device metrics contained in the device management data include, for the computing device that has previously accessed the secure content, a respective unique computing device identifier, and
wherein one of the second set of security verifications that is implemented in accordance with the second security protocol includes triggering execution of 2FA when a unique computing device identifier stored on the computing device does not match a unique computing device identifier that is included as part of the device management data.
5. The computer-implemented method of claim 1 , wherein the one or more device metrics contained in the device management data include, for the computing device that has previously accessed the secure content, (i) a respective unique computing device identifier, and (ii) one or more respective numeric values associated with physical and operational aspects of the computing device, and
wherein the unique computing device identifier is a hashed value that is generated by applying, for the computing device that has previously accessed the secure content, a hashing function to a concatenation of the one or more respective numeric values.
6. The computer-implemented method of claim 5 , wherein the second set of security verifications include:
(i) verifying that a unique computing device identifier stored on the computing device matches a respective unique computing device identifier included as part of the device management data,
(ii) verifying that the respective unique computing device identifier included as part of the device management data indicates that the computing device is authorized to currently access the secure content, and
(ii) verifying that one or more numeric values associated with the physical and operational aspects of the computing device that are stored on the computing device match respective one or more numeric values included as part of the device management data.
7. The computer-implemented method of claim 5 , wherein the physical aspects of the computing device include a type of computing device and a screen size, and
wherein the operational aspects of the computing device include a type of web browser and a random number that was generated in response to the computing device previously accessing the secure content.