Secure authentication of a user of a device during a session with a connected server
Method for a secure authenticating of a user identity of a device for a service during a session including a transaction between an authentication-client and a connected authentication-server, whereby said authentication-client is running on said device using a user-agent with a specific authentication-interface to communicate encrypted authentication messages using a Transport Layer Security (TLS) protocol between said user-agent of said authentication-client and a web-server of both said authentication-server of a ‘Relying Party’ using a unique and secret authentication-identifier (e.g. a hash-value created from ‘Relying Party’, date and time) between them, and a Behaviometric-server using a unique and secret Behaviometric-identifier (e.g. a hash-value created from a Behaviometric-Server, date and time) between them, whereby said session comprising an earlier authentication stage and at least in authentication case (said user identity is positively authenticated) a later controlling stage. Also a related computer program algorithm and a computer-system executing this.
1. A method for securely authenticating a user to a service for executing a transaction, the method being carried out in a system including:
a user device operated by the user, the user device including an authentication-client using a user-agent with a specific authentication-interface for encrypted communication of authentication messages;
an authentication server of a relying party providing the service;
a behaviometric server in communication with the user agent of the user device and with the authentication server using an authentication identifier; and
a web-server associated with the relying party, the web-server being in communication with the authentication server, the authentication client, and the behaviometric server,
the method comprising:
a, in an authentication stage:
upon user initiation of the session by establishing a TLS-connection between the user-agent and the web-server of the relying party, at the web server, generating a unique session identifier;
attempting to authenticate the user device to the service; and
if said attempting to authenticate fails, rejecting access of the user device to the service; or
if said attempting to authenticate succeeds, flagging said user device as being authenticated; and
b. in a controlling stage:
collecting behavioral data from at least one user input component of the user device during said session with said session-identifier by a background process and storing said collected behavioral data on a non-transitory storage medium housed in the user device;
transmitting at least a portion of said stored behavioral data from the user device to the web-server, which conveys a Behavioral-identifier and at least a portion of said stored behavioral data to the behaviometric-server;
at said behaviometric server, and based on at least said portion of said stored behavioral data, determining whether an identity of the user is still valid; and
if the user identity is determined to no longer be valid, carrying out at least one of closing the session or raising an alert by the behaviometric-server, and transmitting said alert to the web-server of the relying party.
2. The method of claim 1 , wherein said controlling stage is performed periodically.
3. The method of claim 1 , wherein said collecting said behavioral data, said storing said collected behavioral data, and said transmitting at least a portion of said stored behavioral data to the behaviometric-server are carried out continuously.
4. The method of claim 1 , wherein said determining whether an identity of the user is still valid includes checking whether at least said portion of said stored behavioral data displays bot-program-characteristics.
5. The method of claim 1 , wherein said determining whether at an identity of the user is still valid includes checking whether at least said portion of said stored behavioral data displays remote-access characteristics.
6. The method of claim 1 , wherein said determining whether an identity of the user is still valid includes comparing at least said portion of said stored behavioral data to stored user-specific behavioral data of the user collected during prior use of the service of the relying party by the user.
7. The method of claim 6 , wherein said determining whether an identity of the user is still valid includes, if said at least said portion of said stored behavioral data does not match said stored user-specific behavioral data, indicating fraudulent access to the service.
8. The method of claim 1 , wherein said the authentication-client is a FIDO client, the authentication-server is a FIDO-server, and said attempting to authenticate the user device includes carrying out an authentication process that fulfills the FIDO standard.
9. The method of claim 1 , wherein the behaviometric server includes a decryption server, and wherein said transmitting comprises transmitting said at least a portion of said behavioral data when said data is encrypted.
10. The method of claim 1 , wherein said attempting to authenticate includes, sending, from the behaviometric-server to the authentication-server, a message including at least one of a ‘Transaction Text’ or a ‘Challenge’ signed or encrypted by at least one of a Message Authentication Code (MAC) or a behaviometric-server-certificate, and, at the authentication server, generating an ‘Authentification Request’ message including said at least one of said ‘Transaction Text’ or said ‘Challenge’.
11. The method of claim 1 , wherein said collecting said behavioral data includes sending an input form requiring insertion of a text string from the web server to the user device.
12. The method of claim 1 , wherein said attempting to authenticate includes requesting the user to provide a PIN related to user.
13. The method of claim 1 , wherein said transmitting includes sending at least one of additional user information or transactional data from the user device to the behavioral server, together with said at least a portion of said behavioral data.
14. The method of claim 1 , wherein said attempting to authenticate includes:
transmitting an ‘Initiate Transaction’ message including said authentication-identifier and transactional information and at least some behavioral data from the authentication client, via said TLS-connection, to the web-server; and
conveying said ‘Initiate Transaction’ message from the web server to the behaviometric-server.
15. The method of claim 1 , wherein the behaviometric-server is located outside of the authentication-server and of a protected area of the relying party.
16. The method of claim 1 , wherein said behavioral data includes at least one of touch gestures, keyboard actions, data captured from a gyrostatic sensor, an accelerometer, or a Global Positioning System during movement of the user device, keystroke patterns, keystroke style, use of particular applications, and speech recognition.
17. The method of claim 1 , wherein the user device is a mobile computing device.
18. The method of claim 14 , wherein said attempting to authenticate includes:
capturing device-information of the user device;
transmitting said captured device-information to said behaviometric-server;
storing the device-information in the behaviometric server as data related to said at least some behavioral data; and
in a subsequent authentication stage, following an initial rejection of the user identity, selecting said at least some behavioral data dependent on said device-information.
19. The method of claim 1 , further comprising, if said attempting to authenticate fails multiple times, prohibiting the transaction requested by the user.