Personal device network for user identification and authentication
Established user habits in carrying multiple wirelessly detectable devices are used to provide or substantiate authentication. In some embodiments, simply detecting that expected devices are co-located within a limited spatial region is sufficient to establish that the devices are being carried by a single individual. In other embodiments, particularly where the potential for spoofing by multiple individuals is a concern, single-user possession of the devices may be confirmed by various corroborative techniques. This approach affords convenience to users, who may be working at a device that lacks the necessary modality (e.g., a fingerprint or vein reader) for strong authentication.
1. A method for authenticating a user seeking access to a secure resource, the method comprising:
at a first time, allowing the user to access the secure resource on a first client node on the basis of a first authentication mode in accordance with a security policy, wherein the first client node is not a wireless device of the user;
after the user has accessed the secure resource, enrolling one or more wireless devices co-located with the user and the first client node by associating the one or more wireless devices with the user in an identity database; and
at a second time after the first time, allowing the user to access the secure resource on a second client node on the basis of a second authentication mode in accordance with the security policy without requiring the first authentication mode, wherein the second authentication mode comprises co-location of one or more enrolled wireless devices with the user and the second client node.
2. The method of claim 1 , wherein the first authentication mode comprises a biometric credential received from the user.
3. The method of claim 1 , wherein the second authentication mode comprises co-location of a plurality of enrolled wireless devices with the user and the second client node.
4. The method of claim 1 , wherein the second authentication mode comprises co-location of three or more enrolled wireless devices with the user and the second client node.
5. The method of claim 1 , wherein the second authentication mode consists of co-location of a plurality of enrolled wireless devices with the user and the second client node.
6. The method of claim 1 , wherein the second authentication mode comprises (i) co-location of one or more enrolled wireless devices with the user and the second client node and (ii) one or more of a password or confirmation of physical presence of the user via a perimeter entry monitor.
7. The method of claim 1 , wherein enrolling one or more wireless devices comprises, for each said wireless device, receiving one or more unique signatures of the wireless device from the user and storing the one or more unique signatures in the identity database.
8. The method of claim 1 , wherein enrolling one or more wireless devices comprises, for each said wireless device, (i) creating a signature for the wireless device, and (ii) storing the signature or a link thereto in the identity database.
9. The method of claim 8 , wherein creating the signature for the wireless device comprises embedding a cryptographic token on the wireless device.
10. The method of claim 8 , wherein the signature for the wireless device is generated on the basis of one or more unique properties of the wireless device.
11. The method of claim 10 , wherein the one or more unique properties of the wireless device comprises at least one of a serial number or a phone number.
12. The method of claim 1 , wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, storing an identifier associated therewith in the identity database.
13. The method of claim 1 , wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, (a) prompting the user whether or not to enroll the wireless device and (b) for wireless devices to be enrolled, storing an identifier associated therewith in the identity database.
14. The method of claim 1 , further comprising, after the user has accessed the secure resource on the first client node, (i) verifying the co-location, with the user and the first client node, of all wireless devices associated with the user in the identity database, and (ii) for any wireless device associated with the user but not co-located with the user and the first client node, at least one of (a) decrementing a counter associated with the wireless device or (b) disassociating the wireless device from the user in the identity database.
15. The method of claim 1 , wherein the first authentication mode does not comprise co-location of one or more enrolled wireless devices with the user and the first client node.
16. The method of claim 1 , wherein the second client node is not a wireless device of the user.
17. The method of claim 1 , wherein the first authentication mode comprises receiving log-in credentials input by the user on the first client node.
18. The method of claim 1 , wherein the second authentication mode further comprises receiving log-in credentials input by the user on the second client node.
19. A method for authenticating a user seeking access to a secure resource, the user having previously accessed the secure resource on the basis of a first authentication mode in accordance with a security policy, the method comprising:
enrolling one or more wireless devices co-located with the user and a first client node by associating the one or more wireless devices with the user in an identity database; and
allowing the user to access the secure resource on a second client node on the basis of a second authentication mode in accordance with the security policy without requiring the first authentication mode, wherein the second authentication mode comprises co-location of one or more enrolled wireless devices with the user and the second client node,
wherein the second client node is not a wireless device of the user.
20. The method of claim 19 , wherein the first authentication mode comprises a biometric credential received from the user.
21. The method of claim 19 , wherein enrolling one or more wireless devices comprises, for each said wireless device, receiving one or more unique signatures of the wireless device from the user and storing the one or more unique signatures in the identity database.
22. The method of claim 19 , wherein enrolling one or more wireless devices comprises, for each said wireless device, (i) creating a signature for the wireless device, and (ii) storing the signature or a link thereto in the identity database.
23. The method of claim 19 , wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, storing an identifier associated therewith in the identity database.
24. The method of claim 19 , wherein enrolling one or more wireless devices comprises (i) electronically detecting the one or more wireless devices co-located with the user and the first client node and (ii) for each said wireless device not already enrolled, (a) prompting the user whether or not to enroll the wireless device and (b) for wireless devices to be enrolled, storing an identifier associated therewith in the identity database.
25. The method of claim 19 , wherein the first authentication mode does not comprise co-location of one or more enrolled wireless devices with the user and the first client node.
26. The method of claim 19 , wherein the second authentication mode further comprises receiving log-in credentials input by the user on the second client node.
27. The method of claim 19 , further comprising, before allowing the user to access the secure resource on the second client node, (i) verifying the co-location, with the user and the first client node, of all wireless devices associated with the user in the identity database, and (ii) for any wireless device associated with the user but not co-located with the user and the first client node, at least one of (a) decrementing a counter associated with the wireless device or (b) disassociating the wireless device from the user in the identity database.